Background: #fff
Foreground: #000
PrimaryPale: #8cf
PrimaryLight: #18f
PrimaryMid: #04b
PrimaryDark: #014
SecondaryPale: #ffc
SecondaryLight: #fe8
SecondaryMid: #db4
SecondaryDark: #841
TertiaryPale: #eee
TertiaryLight: #ccc
TertiaryMid: #999
TertiaryDark: #666
Error: #f88
<!--{{{-->
<link rel='stylesheet' href='font-awesome/css/fontawesome.min.css' />
<link rel='stylesheet' href='font-awesome/css/all.css' />
<!--}}}-->
— [[InterfaceOptions]] — [[AdvancedOptions]] —
<!--{{{-->
<div class='header' role='banner' macro='gradient vert [[ColorPalette::PrimaryDark]] [[ColorPalette::PrimaryLight]]'>
<div class='headerShadow'>
<img src="iCSF/cloud-security-alliance-fr.png" align="right">
</div>
<div class='headerForeground'>
<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;
<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>&nbsp;
</div>
</div>
<div id='mainMenu' role='navigation' refresh='content' tiddler='MainMenu'></div>
<div id='sidebar'>
<div id='sidebarOptions' role='navigation' refresh='content' tiddler='SideBarOptions'></div>
<div id='sidebarTabs' role='complementary' refresh='content' force='true' tiddler='SideBarTabs'></div>
</div>
<div id='displayArea' role='main'>
<div id='messageArea' class='messageArea'></div>
<div style="text-align:center"><span class='HeaderMenu' refresh='content' tiddler='HeaderMenu'></span></div>
<div id='tiddlerDisplay'></div>
<div style="text-align:center"><span class='FooterNews' refresh='content' tiddler='FooterDisclaimer'></span></div>
</div>
<!--}}}-->
/*{{{*/
body {background:[[ColorPalette::Background]]; color:[[ColorPalette::Foreground]];}
a {color:[[ColorPalette::PrimaryMid]];}
a:hover {background-color:[[ColorPalette::PrimaryMid]]; color:[[ColorPalette::Background]];}
a img {border:0;}
h1,h2,h3,h4,h5,h6 {color:[[ColorPalette::SecondaryDark]]; background:transparent;}
h1 {border-bottom:2px solid [[ColorPalette::TertiaryLight]];}
h2,h3 {border-bottom:1px solid [[ColorPalette::TertiaryLight]];}
.button {color:[[ColorPalette::PrimaryDark]]; border:1px solid [[ColorPalette::Background]];}
.button:hover {color:[[ColorPalette::PrimaryDark]]; background:[[ColorPalette::SecondaryLight]]; border-color:[[ColorPalette::SecondaryMid]];}
.button:active {color:[[ColorPalette::Background]]; background:[[ColorPalette::SecondaryMid]]; border:1px solid [[ColorPalette::SecondaryDark]];}
.header {background:[[ColorPalette::PrimaryMid]];}
.headerShadow {color:[[ColorPalette::Foreground]];}
.headerShadow a {font-weight:normal; color:[[ColorPalette::Foreground]];}
.headerForeground {color:[[ColorPalette::Background]];}
.headerForeground a {font-weight:normal; color:[[ColorPalette::PrimaryPale]];}
.tabSelected {color:[[ColorPalette::PrimaryDark]];
 background:[[ColorPalette::TertiaryPale]];
 border-left:1px solid [[ColorPalette::TertiaryLight]];
 border-top:1px solid [[ColorPalette::TertiaryLight]];
 border-right:1px solid [[ColorPalette::TertiaryLight]];
}
.tabUnselected {color:[[ColorPalette::Background]]; background:[[ColorPalette::TertiaryMid]];}
.tabContents {color:[[ColorPalette::PrimaryDark]]; background:[[ColorPalette::TertiaryPale]]; border:1px solid [[ColorPalette::TertiaryLight]];}
.tabContents .button {border:0;}
#sidebar { display: none; }
/* #sidebar {} */
#sidebarOptions input {border:1px solid [[ColorPalette::PrimaryMid]];}
#sidebarOptions .sliderPanel {background:[[ColorPalette::PrimaryPale]];}
#sidebarOptions .sliderPanel a {border:none;color:[[ColorPalette::PrimaryMid]];}
#sidebarOptions .sliderPanel a:hover {color:[[ColorPalette::Background]]; background:[[ColorPalette::PrimaryMid]];}
#sidebarOptions .sliderPanel a:active {color:[[ColorPalette::PrimaryMid]]; background:[[ColorPalette::Background]];}
.wizard { background:[[ColorPalette::PrimaryPale]]; }
.wizard__title { color:[[ColorPalette::PrimaryDark]]; border:none; }
.wizard__subtitle { color:[[ColorPalette::Foreground]]; border:none; }
.wizardStep { background:[[ColorPalette::Background]]; color:[[ColorPalette::Foreground]]; }
.wizardStep.wizardStepDone {background:[[ColorPalette::TertiaryLight]];}
.wizardFooter {background:[[ColorPalette::PrimaryPale]];}
.wizardFooter .status {background:[[ColorPalette::PrimaryDark]]; color:[[ColorPalette::Background]];}
.wizard .button {color:[[ColorPalette::Foreground]]; background:[[ColorPalette::SecondaryLight]]; border: 1px solid;
 border-color:[[ColorPalette::SecondaryPale]] [[ColorPalette::SecondaryDark]] [[ColorPalette::SecondaryDark]] [[ColorPalette::SecondaryPale]];}
.wizard .button:hover {color:[[ColorPalette::Foreground]]; background:[[ColorPalette::Background]];}
.wizard .button:active {color:[[ColorPalette::Background]]; background:[[ColorPalette::Foreground]]; border: 1px solid;
 border-color:[[ColorPalette::PrimaryDark]] [[ColorPalette::PrimaryPale]] [[ColorPalette::PrimaryPale]] [[ColorPalette::PrimaryDark]];}
.wizard .notChanged {background:transparent;}
.wizard .changedLocally {background:#80ff80;}
.wizard .changedServer {background:#8080ff;}
.wizard .changedBoth {background:#ff8080;}
.wizard .notFound {background:#ffff80;}
.wizard .putToServer {background:#ff80ff;}
.wizard .gotFromServer {background:#80ffff;}
.messageArea { border:2px solid [[ColorPalette::Background]]; background:[[ColorPalette::PrimaryMid]]; color:[[ColorPalette::Background]]; }
.messageToolbar__button { color:[[ColorPalette::PrimaryMid]]; background:[[ColorPalette::SecondaryPale]]; border:none; }
.messageToolbar__button_withIcon { background:inherit; }
.messageToolbar__button_withIcon:active { background:inherit; border:none; }
.messageToolbar__icon { fill:[[ColorPalette::TertiaryDark]]; }
.messageToolbar__icon:hover { fill:[[ColorPalette::Foreground]]; }
.popupTiddler {background:[[ColorPalette::TertiaryPale]]; border:2px solid [[ColorPalette::TertiaryMid]];}
.popup {background:[[ColorPalette::TertiaryPale]]; color:[[ColorPalette::TertiaryDark]]; border-left:1px solid [[ColorPalette::TertiaryMid]]; border-top:1px solid [[ColorPalette::TertiaryMid]]; border-right:2px solid [[ColorPalette::TertiaryDark]]; border-bottom:2px solid [[ColorPalette::TertiaryDark]]; }
.popup hr {color:[[ColorPalette::PrimaryDark]]; background:[[ColorPalette::PrimaryDark]]; border-bottom:1px;}
.popup li.disabled {color:[[ColorPalette::TertiaryMid]];}
.popup li a, .popup li a:visited {color:[[ColorPalette::Foreground]]; border: none;}
.popup li a:hover {background:[[ColorPalette::SecondaryLight]]; color:[[ColorPalette::Foreground]]; border: none;}
.popup li a:active {background:[[ColorPalette::SecondaryPale]]; color:[[ColorPalette::Foreground]]; border: none;}
.popupHighlight {background:[[ColorPalette::Background]]; color:[[ColorPalette::Foreground]];}
.listBreak div {border-bottom:1px solid [[ColorPalette::TertiaryDark]];}
.tiddler .defaultCommand {font-weight:bold;}
.shadow .title {color:[[ColorPalette::TertiaryDark]];}
.title {color:[[ColorPalette::SecondaryDark]];}
.subtitle {color:[[ColorPalette::TertiaryDark]];}
.toolbar {color:[[ColorPalette::PrimaryMid]];}
.toolbar a {color:[[ColorPalette::TertiaryLight]];}
.selected .toolbar a {color:[[ColorPalette::TertiaryMid]];}
.selected .toolbar a:hover {color:[[ColorPalette::Foreground]];}
.tagging, .tagged {border:1px solid [[ColorPalette::TertiaryPale]]; background-color:[[ColorPalette::TertiaryPale]];}
.selected .tagging, .selected .tagged {background-color:[[ColorPalette::TertiaryLight]]; border:1px solid [[ColorPalette::TertiaryMid]];}
.tagging .listTitle, .tagged .listTitle {color:[[ColorPalette::PrimaryDark]];}
.tagging .button, .tagged .button {border:none;}
.footer {color:[[ColorPalette::TertiaryLight]];}
.selected .footer {color:[[ColorPalette::TertiaryMid]];}
.error, .errorButton {color:[[ColorPalette::Foreground]]; background:[[ColorPalette::Error]];}
.warning {color:[[ColorPalette::Foreground]]; background:[[ColorPalette::SecondaryPale]];}
.lowlight {background:[[ColorPalette::TertiaryLight]];}
.zoomer {background:none; color:[[ColorPalette::TertiaryMid]]; border:3px solid [[ColorPalette::TertiaryMid]];}
.imageLink, #displayArea .imageLink {background:transparent;}
.annotation {background:[[ColorPalette::SecondaryLight]]; color:[[ColorPalette::Foreground]]; border:2px solid [[ColorPalette::SecondaryMid]];}
.viewer .listTitle {list-style-type:none; margin-left:-2em;}
.viewer .button {border:1px solid [[ColorPalette::SecondaryMid]];}
.viewer blockquote {border-left:3px solid [[ColorPalette::TertiaryDark]];}
.viewer table, table.twtable {border:2px solid [[ColorPalette::TertiaryDark]];}
.viewer th, .viewer thead td, .twtable th, .twtable thead td {background:[[ColorPalette::SecondaryMid]]; border:1px solid [[ColorPalette::TertiaryDark]]; color:[[ColorPalette::Background]];}
.viewer td, .viewer tr, .twtable td, .twtable tr {border:1px solid [[ColorPalette::TertiaryDark]];}
.viewer pre {border:1px solid [[ColorPalette::SecondaryLight]]; background:[[ColorPalette::SecondaryPale]];}
.viewer code {color:[[ColorPalette::SecondaryDark]];}
.viewer hr {border:0; border-top:dashed 1px [[ColorPalette::TertiaryDark]]; color:[[ColorPalette::TertiaryDark]];}
.highlight, .marked {background:[[ColorPalette::SecondaryLight]];}
.editor input {border:1px solid [[ColorPalette::PrimaryMid]];}
.editor textarea {border:1px solid [[ColorPalette::PrimaryMid]]; width:100%;}
.editorFooter {color:[[ColorPalette::TertiaryMid]];}
.readOnly {background:[[ColorPalette::TertiaryPale]];}
#backstageArea {background:[[ColorPalette::Foreground]]; color:[[ColorPalette::TertiaryMid]];}
#backstageArea a {background:[[ColorPalette::Foreground]]; color:[[ColorPalette::Background]]; border:none;}
#backstageArea a:hover {background:[[ColorPalette::SecondaryLight]]; color:[[ColorPalette::Foreground]]; }
#backstageArea a.backstageSelTab {background:[[ColorPalette::Background]]; color:[[ColorPalette::Foreground]];}
#backstageButton a {background:none; color:[[ColorPalette::Background]]; border:none;}
#backstageButton a:hover {background:[[ColorPalette::Foreground]]; color:[[ColorPalette::Background]]; border:none;}
#backstagePanel {background:[[ColorPalette::Background]]; border-color: [[ColorPalette::Background]] [[ColorPalette::TertiaryDark]] [[ColorPalette::TertiaryDark]] [[ColorPalette::TertiaryDark]];}
.backstagePanelFooter .button {border:none; color:[[ColorPalette::Background]];}
.backstagePanelFooter .button:hover {color:[[ColorPalette::Foreground]];}
#backstageCloak {background:[[ColorPalette::Foreground]]; opacity:0.6; filter:alpha(opacity=60);}
/*}}}*/
/*{{{*/
* html .tiddler {height:1%;}
/* font-size:.75em; */
body {font-size:1em; font-family:arial,helveticahelvetica; margin:0; padding:0;}
h1,h2,h3,h4,h5,h6 {font-weight:bold; text-decoration:none;}
h1,h2,h3 {padding-bottom:1px; margin-top:1.2em;margin-bottom:0.3em;}
h4,h5,h6 {margin-top:1em;}
h1 {font-size:1.35em;}
h2 {font-size:1.25em;}
h3 {font-size:1.1em;}
h4 {font-size:1em;}
h5 {font-size:1em;}
hr {height:1px;}
a {text-decoration:none;}
dt {font-weight:bold;}
ol {list-style-type:decimal;}
ol ol {list-style-type:lower-alpha;}
ol ol ol {list-style-type:lower-roman;}
ol ol ol ol {list-style-type:decimal;}
ol ol ol ol ol {list-style-type:lower-alpha;}
ol ol ol ol ol ol {list-style-type:lower-roman;}
ol ol ol ol ol ol ol {list-style-type:decimal;}
.txtOptionInput {width:11em;}
#contentWrapper .chkOptionInput {border:0;}
.externalLink {text-decoration:underline;}
.indent {margin-left:3em;}
.outdent {margin-left:3em; text-indent:-3em;}
code.escaped {white-space:nowrap;}
.tiddlyLinkExisting {font-weight:bold;}
.tiddlyLinkNonExisting {font-style:italic;}
/* the 'a' is required for IE, otherwise it renders the whole tiddler in bold */
a.tiddlyLinkNonExisting.shadow {font-weight:bold;}
#mainMenu .tiddlyLinkExisting,
#mainMenu .tiddlyLinkNonExisting,
#sidebarTabs .tiddlyLinkNonExisting {font-weight:normal; font-style:normal;}
#sidebarTabs .tiddlyLinkExisting {font-weight:bold; font-style:normal;}
.header {position:relative;}
.header a:hover {background:transparent;}
.headerShadow {position:relative; padding:4.5em 0 1em 1em; left:-1px; top:-1px;}
.headerForeground {position:absolute; padding:4.5em 0 1em 1em; left:0; top:0;}
.siteTitle {font-size:3em;}
.siteSubtitle {font-size:1.5em;}
#mainMenu {position:absolute; left:0; width:10em; text-align:right; line-height:1.6em; padding:1.5em 0.5em 0.5em 0.5em; font-size:1.1em;}
#sidebar { display: none; }
/* #sidebar {position:absolute; right:3px; width:16em; font-size:.9em;}*/
#sidebarOptions {padding-top:0.3em;}
#sidebarOptions a {margin:0 0.2em; padding:0.2em 0.3em; display:block;}
#sidebarOptions input {margin:0.4em 0.5em;}
#sidebarOptions .sliderPanel {margin-left:1em; padding:0.5em; font-size:.85em;}
#sidebarOptions .sliderPanel a {font-weight:bold; display:inline; padding:0;}
#sidebarOptions .sliderPanel input {margin:0 0 0.3em 0;}
#sidebarTabs .tabContents {width:15em; overflow:hidden;}
.wizard { padding:0.1em 2em 0; }
.wizard__title { font-size:2em; }
.wizard__subtitle { font-size:1.2em; }
.wizard__title, .wizard__subtitle { font-weight:bold; background:none; padding:0; margin:0.4em 0 0.2em; }
.wizardStep { padding:1em; }
.wizardFooter { padding:0.8em 0.4em 0.8em 0; }
.wizardFooter .status { padding:0.2em 0.7em; margin-left:0.3em; }
.wizardFooter .button { margin:0.5em 0 0; font-size:1.2em; padding:0.2em 0.5em; }
.messageArea { position:fixed; top:0; right:20em; margin:0.5em; padding:0.7em 1em; z-index:2000; }
.messageToolbar { text-align:right; padding:0.2em 0; }
.messageToolbar__button { text-decoration:underline; }
.messageToolbar__icon { height: 1em; }
.messageArea__text a { text-decoration:underline; }
.tiddlerPopupButton {padding:0.2em;}
.popupTiddler {position: absolute; z-index:300; padding:1em; margin:0;}
.popup {position:absolute; z-index:300; font-size:.9em; padding:0.3em 0; list-style:none; margin:0; padding: 0.3em 0; border: none; box-shadow: 1px 2px 5px [[ColorPalette::TertiaryMid]];}
.popup .popupMessage {padding:0.4em;}
.popup hr {display:block; height:1px; width:auto; padding:0; margin:0.2em 0;}
.popup li.disabled {padding:0.4em;}
.popup li a {display:block; padding: 0.5em 0.5em; font-weight:normal; cursor:pointer;}
.listBreak {font-size:1px; line-height:1px;}
.listBreak div {margin:2px 0;}
.tabset {padding:1em 0 0 0.5em;}
.tab {margin:0 0 0 0.25em; padding:2px;}
.tabContents {padding:0.5em;}
.tabContents ul, .tabContents ol {margin:0; padding:0;}
.txtMainTab .tabContents li {list-style:none;}
.tabContents li.listLink { margin-left:.75em;}
#contentWrapper {display:block;}
#splashScreen {display:none;}
#displayArea {margin:0 4em 0 14em;}
/* 0C #displayArea {margin:1em 17em 0 14em;} */
.toolbar {text-align:right; font-size:.9em;}
.tiddler {padding:1em 1em 0;}
.missing .viewer,.missing .title {font-style:italic;}
.title {font-size:1.6em; font-weight:bold;}
.missing .subtitle {display:none;}
.subtitle {font-size:1.1em;}
.tiddler .button {padding:0.2em 0.4em;}
.tagging {margin:0.5em 0.5em 0.5em 0; float:left; display:none;}
.isTag .tagging {display:block;}
.tagged {margin:0.5em; float:right;}
.tagging, .tagged {font-size:0.9em; padding:0.25em;}
.tagging ul, .tagged ul {list-style:none; margin:0.25em; padding:0;}
.tagClear {clear:both;}
.footer {font-size:.9em;}
.footer li {display:inline;}
.annotation {padding:0.5em; margin:0.5em;}
* html .viewer pre {width:99%; padding:0 0 1em 0;}
.viewer {line-height:1.4em; padding-top:0.5em;}
.viewer .button {margin:0 0.25em; padding:0 0.25em;}
.viewer blockquote {line-height:1.5em; padding-left:0.8em;margin-left:2.5em;}
.viewer ul, .viewer ol {margin-left:0.5em; padding-left:1.5em;}
.viewer table, table.twtable {border-collapse:collapse; margin:0.8em 1.0em;}
.viewer th, .viewer td, .viewer tr,.viewer caption,.twtable th, .twtable td, .twtable tr,.twtable caption {padding:3px;}
table.listView {font-size:0.85em; margin:0.8em 1.0em;}
table.listView th, table.listView td, table.listView tr {padding:0 3px 0 3px;}
.viewer pre {padding:0.5em; margin-left:0.5em; font-size:1.2em; line-height:1.4em; overflow:auto;}
.viewer code {font-size:1.2em; line-height:1.4em;}
.editor {font-size:1.1em;}
.editor input, .editor textarea {display:block; width:100%; box-sizing: border-box; font:inherit;}
.editorFooter {padding:0.25em 0; font-size:.9em;}
.editorFooter .button {padding-top:0; padding-bottom:0;}
.fieldsetFix {border:0; padding:0; margin:1px 0px;}
.zoomer {font-size:1.1em; position:absolute; overflow:hidden;}
.zoomer div {padding:1em;}
* html #backstage {width:99%;}
* html #backstageArea {width:99%;}
#backstageArea {display:none; position:relative; overflow: hidden; z-index:150; padding:0.3em 0.5em;}
#backstageToolbar {position:relative;}
#backstageArea a {font-weight:bold; margin-left:0.5em; padding:0.3em 0.5em;}
#backstageButton {display:none; position:absolute; z-index:175; top:0; right:0;}
#backstageButton a {padding:0.1em 0.4em; margin:0.1em;}
#backstage {position:relative; width:100%; z-index:50;}
#backstagePanel { display:none; z-index:100; position:absolute; width:90%; margin-left:3em; }
.backstagePanelFooter {padding-top:0.2em; float:right;}
.backstagePanelFooter a {padding:0.2em 0.4em;}
#backstageCloak {display:none; z-index:20; position:absolute; width:100%; height:100px;}
.whenBackstage {display:none;}
.backstageVisible .whenBackstage {display:block;}
/*}}}*/
/*{{{*/
body {font-size:1em;}
#sidebarOptions {font-size:1.05em;}
#sidebarOptions a {font-style:normal;}
#sidebarOptions .sliderPanel {font-size:0.95em;}
.subtitle {font-size:0.8em;}
.viewer table.listView {font-size:0.95em;}
/*}}}*/
/*{{{*/
@media print {
#mainMenu, #sidebar, .messageArea, .toolbar, #backstageButton, #backstageArea {display: none !important;}
#displayArea { margin-right: 0; }
/* #displayArea {margin: 1em 1em 0em;} */
noscript {display:none;}
}
/*}}}*/
<!--{{{-->
<div class='toolbar' role='navigation' macro='toolbar [[ToolbarCommands::ViewToolbar]]'></div>
<div class='title' macro='view title'></div>
<div class='viewer' macro='view text wikified'></div>
<div class='tagClear'></div>
<!--}}}-->
/% |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
!show
<<tiddler {{
 var co=config.options;
 if (co.chkShowLeftSidebar===undefined) co.chkShowLeftSidebar=true;
 var mm=document.getElementById('mainMenu');
 var da=document.getElementById('displayArea');
 if (mm) {
 mm.style.display=co.chkShowLeftSidebar?'block':'none';
 da.style.marginLeft=co.chkShowLeftSidebar?'':'1em';
 }
'';}}>><html><nowiki><a href='javascript:;' title="$2"
onmouseover="
 this.href='javascript:void(eval(decodeURIComponent(%22(function(){try{('
 +encodeURIComponent(encodeURIComponent(this.onclick))
 +')()}catch(e){alert(e.description?e.description:e.toString())}})()%22)))';"
onclick="
 var co=config.options;
 var opt='chkShowLeftSidebar';
 var show=co[opt]=!co[opt];
 var mm=document.getElementById('mainMenu');
 var da=document.getElementById('displayArea');
 if (mm) {
 mm.style.display=show?'block':'none';
 da.style.marginLeft=show?'':'1em';
 }
 saveOptionCookie(opt);
 var labelShow=co.txtToggleLeftSideBarLabelShow||'&#x25BA;';
 var labelHide=co.txtToggleLeftSideBarLabelHide||'&#x25C4;';
 if (this.innerHTML==labelShow||this.innerHTML==labelHide)
 this.innerHTML=show?labelHide:labelShow;
 this.title=(show?'masquer':'montrer')+' le menu à gauche';
 var sm=document.getElementById('storyMenu');
 if (sm) config.refreshers.content(sm);
 return false;
">$1</a></html>
!end
%/<<tiddler {{
 var src='.ToggleLeftSidebar';
 src+(tiddler&&tiddler.title==src?'##info':'##show');
}} with: {{
 var co=config.options;
 var labelShow=co.txtToggleLeftSideBarLabelShow||'&#x25BA;&#x25C1;'; /%0C%/
 var labelHide=co.txtToggleLeftSideBarLabelHide||'&#x25C4;&#x25B7;'; /%0C%/
 '$1'!='$'+'1'?'$1':(co.chkShowLeftSidebar?labelHide:labelShow);
}} {{
 var tip=(config.options.chkShowLeftSidebar?'cacher':'montrer')+' le menu gauche'; /%0C%/
 '$2'!='$'+'2'?'$2':tip;
}}>>
/% |Author|Eric Shulman|License|https://www.TiddlyTools.com/#LegalStatements|
%/<html><nowiki><a href="javascript:;" title="masquer/montrer l'en-tête" /%0C%/
onmouseover="
 this.href='javascript:void(eval(decodeURIComponent(%22(function(){try{('
 +encodeURIComponent(encodeURIComponent(this.onclick))
 +')()}catch(e){alert(e.description?e.description:e.toString())}})()%22)))';"
onclick="
 var c=document.getElementById('contentWrapper'); if (!c) return;
 for (var i=0; i<c.childNodes.length; i++)
 if (hasClass(c.childNodes[i],'header')) { var h=c.childNodes[i]; break; }
 if (!h) return;
 config.options.chkHideSiteTitles=h.style.display!='none';
 h.style.display=config.options.chkHideSiteTitles?'none':'block';
 saveOptionCookie('chkHideSiteTitles');
 return false;
">&#x25b3;&#x25bc;</a></html>
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
*/
//{{{
version.extensions.BreadcrumbsPlugin= {major: 2, minor: 1, revision: 4, date: new Date(2011,2,16)};
var defaults={
 chkShowBreadcrumbs: true,
 chkReorderBreadcrumbs: true,
 chkCreateDefaultBreadcrumbs: true,
 chkShowStartupBreadcrumbs: false,
 chkBreadcrumbsReverse: false,
 chkBreadcrumbsLimit: false,
 txtBreadcrumbsLimit: 5,
 chkBreadcrumbsLimitOpenTiddlers:false,
 txtBreadcrumbsLimitOpenTiddlers:3,
 chkBreadcrumbsHideHomeLink: false,
 chkBreadcrumbsSave: false,
 txtBreadcrumbsHomeSeparator: ' | ',
 txtBreadcrumbsCrumbSeparator: ' > '
};
for (var id in defaults) if (config.options[id]===undefined)
 config.options[id]=defaults[id];
config.macros.breadcrumbs = {
 crumbs: [], // the list of current breadcrumbs
 askMsg: "Save current breadcrumbs before clearing?\n"
 +"Press OK to save, or CANCEL to continue without saving.",
 saveMsg: 'Enter the name of a tiddler in which to save the current breadcrumbs',
 saveTitle: 'SavedBreadcrumbs',
 handler: function(place,macroName,params,wikifier,paramString,tiddler) {
 var area=createTiddlyElement(place,"span",null,"breadCrumbs",null);
 area.setAttribute("homeSep",params[0]||config.options.txtBreadcrumbsHomeSeparator);
 area.setAttribute("crumbSep",params[1]||config.options.txtBreadcrumbsCrumbSeparator);
 this.render(area);
 },
 add: function (title) {
 var thisCrumb = title;
 var ind = this.crumbs.indexOf(thisCrumb);
 if(ind === -1)
 this.crumbs.push(thisCrumb);
 else if (config.options.chkReorderBreadcrumbs)
 this.crumbs.push(this.crumbs.splice(ind,1)[0]); // reorder crumbs
 else
 this.crumbs=this.crumbs.slice(0,ind+1); // trim crumbs
 if (config.options.chkBreadcrumbsLimitOpenTiddlers)
 this.limitOpenTiddlers();
 this.refresh();
 return false;
 },
 getAreas: function() {
 var crumbAreas=[];
 // find all DIVs with classname=="breadCrumbs"
 var all=document.getElementsByTagName("*");
 for (var i=0; i<all.length; i++)
 try{ if (hasClass(all[i],"breadCrumbs")) crumbAreas.push(all[i]); } catch(e) {;}
 // or, find single DIV w/fixed ID (backward compatibility)
 var byID=document.getElementById("breadCrumbs")
 if (byID && !hasClass(byID,"breadCrumbs")) crumbAreas.push(byID);
 if (!crumbAreas.length && config.options.chkCreateDefaultBreadcrumbs) {
 // no crumbs display... create one
 var defaultArea = createTiddlyElement(null,"span",null,"breadCrumbs",null);
 defaultArea.style.display= "none";
 var targetArea= document.getElementById("tiddlerDisplay");
 targetArea.parentNode.insertBefore(defaultArea,targetArea);
 crumbAreas.push(defaultArea);
 }
 return crumbAreas;
 },
 refresh: function() {
 var crumbAreas=this.getAreas();
 for (var i=0; i<crumbAreas.length; i++) {
 crumbAreas[i].style.display = config.options.chkShowBreadcrumbs?"inline":"none";
 removeChildren(crumbAreas[i]);
 this.render(crumbAreas[i]);
 }
 },
 render: function(here) {
 var co=config.options; var out=""
 if (!co.chkBreadcrumbsHideHomeLink) {
 createTiddlyButton(here,"Accueil",null,this.home,"tiddlyLink tiddlyLinkExisting");
 out+=here.getAttribute("homeSep")||config.options.txtBreadcrumbsHomeSeparator;
 }
 for (c=0; c<this.crumbs.length; c++) // remove non-existing tiddlers from crumbs
 if (!store.tiddlerExists(this.crumbs[c]) && !store.isShadowTiddler(this.crumbs[c]))
 this.crumbs.splice(c,1);
 var count=this.crumbs.length;
 if (co.chkBreadcrumbsLimit && co.txtBreadcrumbsLimit<count) count=co.txtBreadcrumbsLimit;
 var list=[];
 for (c=this.crumbs.length-count; c<this.crumbs.length; c++) list.push('[['+this.crumbs[c]+']]');
 if (co.chkBreadcrumbsReverse) list.reverse();
 out+=list.join(here.getAttribute("crumbSep")||config.options.txtBreadcrumbsCrumbSeparator);
 wikify(out,here);
 },
 home: function() {
 var cmb=config.macros.breadcrumbs;
 if (config.options.chkBreadcrumbsSave && confirm(cmb.askMsg)) cmb.saveCrumbs();
 story.closeAllTiddlers(); restart();
 cmb.crumbs = []; var crumbAreas=cmb.getAreas();
 for (var i=0; i<crumbAreas.length; i++) crumbAreas[i].style.display = "none";
 return false;
 },
 saveCrumbs: function() {
 var tid=prompt(this.saveMsg,this.saveTitle); if (!tid||!tid.length) return; // cancelled by user
 var t=store.getTiddler(tid);
 if(t && !confirm(config.messages.overwriteWarning.format([tid]))) return;
 var who=config.options.txtUserName;
 var when=new Date();
 var text='[['+this.crumbs.join(']]\n[[')+']]';
 var tags=t?t.tags:[]; tags.pushUnique('story');
 var fields=t?t.fields:{};
 store.saveTiddler(tid,tid,text,who,when,tags,fields);
 story.displayTiddler(null,tid);
 story.refreshTiddler(tid,null,true);
 displayMessage(tid+' has been '+(t?'updated':'created'));
 },
 limitOpenTiddlers: function() {
 var limit=config.options.txtBreadcrumbsLimitOpenTiddlers; if (limit<1) limit=1;
 for (c=this.crumbs.length-1; c>=0; c--) {
 var tid=this.crumbs[c];
 var elem=story.getTiddler(tid);
 if (elem) { // tiddler is displayed
 if (limit <=0) { // display limit has been reached
 if (elem.getAttribute("dirty")=="true") { // tiddler is being edited
 var msg= "'"+tid+"' is currently being edited.\n\n"
 +"Press OK to save and close this tiddler\n"
 +"or press Cancel to leave it opened";
 if (confirm(msg)) {
 story.closeTiddler(tid);
 }
 }
 else story.closeTiddler(this.crumbs[c]);
 }
 limit--;
 }
 }
 }
};
//}}}
// // PreviousTiddler ('back') command and macro
//{{{
config.commands.previousTiddler = {
 text: 'back',
 tooltip: 'view the previous tiddler',
 handler: function(event,src,title) {
 var crumbs=config.macros.breadcrumbs.crumbs;
 if (crumbs.length<2) config.macros.breadcrumbs.home();
 else story.displayTiddler(story.findContainingTiddler(src),crumbs[crumbs.length-2]);
 return false;
 }
};
config.macros.previousTiddler= {
 label: 'back',
 prompt: 'view the previous tiddler',
 handler: function(place,macroName,params,wikifier,paramString,tiddler) {
 var label=params.shift(); if (!label) label=this.label;
 var prompt=params.shift(); if (!prompt) prompt=this.prompt;
 createTiddlyButton(place,label,prompt,function(ev){
 return config.commands.previousTiddler.handler(ev,this)
 });
 }
}//}}}
// // HIJACKS
//{{{
// update crumbs when a tiddler is displayed
if (Story.prototype.breadCrumbs_coreDisplayTiddler==undefined)
 Story.prototype.breadCrumbs_coreDisplayTiddler=Story.prototype.displayTiddler;
Story.prototype.displayTiddler = function(srcElement,tiddler) {
 var title=(tiddler instanceof Tiddler)?tiddler.title:tiddler;
 this.breadCrumbs_coreDisplayTiddler.apply(this,arguments);
 if (!startingUp || config.options.chkShowStartupBreadcrumbs)
 config.macros.breadcrumbs.add(title);
}
// update crumbs when a tiddler is deleted
if (TiddlyWiki.prototype.breadCrumbs_coreRemoveTiddler==undefined)
 TiddlyWiki.prototype.breadCrumbs_coreRemoveTiddler=TiddlyWiki.prototype.removeTiddler;
TiddlyWiki.prototype.removeTiddler= function() {
 this.breadCrumbs_coreRemoveTiddler.apply(this,arguments);
 config.macros.breadcrumbs.refresh();
}
//}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
!Configuration
<<<
<<option chkDisableWikiLinks>> Disable ALL automatic WikiWord tiddler links
<<option chkAllowLinksFromShadowTiddlers>> ... except for WikiWords //contained in// shadow tiddlers
<<option chkDisableNonExistingWikiLinks>> Disable automatic WikiWord links for non-existing tiddlers
Disable automatic WikiWord links for words listed in: <<option txtDisableWikiLinksList>>
Disable automatic WikiWord links for tiddlers tagged with: <<option txtDisableWikiLinksTag>>
<<<
!Code
*/
//{{{
version.extensions.DisableWikiLinksPlugin= {major: 1, minor: 6, revision: 0, date: new Date(2008,7,22)};
if (config.options.chkDisableNonExistingWikiLinks==undefined) config.options.chkDisableNonExistingWikiLinks= false;
if (config.options.chkDisableWikiLinks==undefined) config.options.chkDisableWikiLinks=false;
if (config.options.txtDisableWikiLinksList==undefined) config.options.txtDisableWikiLinksList="DisableWikiLinksList";
if (config.options.chkAllowLinksFromShadowTiddlers==undefined) config.options.chkAllowLinksFromShadowTiddlers=true;
if (config.options.txtDisableWikiLinksTag==undefined) config.options.txtDisableWikiLinksTag="excludeWikiWords";
// find the formatter for wikiLink and replace handler with 'pass-thru' rendering
initDisableWikiLinksFormatter();
function initDisableWikiLinksFormatter() {
 for (var i=0; i<config.formatters.length && config.formatters[i].name!="wikiLink"; i++);
 config.formatters[i].coreHandler=config.formatters[i].handler;
 config.formatters[i].handler=function(w) {
  // supress any leading "~" (if present)
  var skip=(w.matchText.substr(0,1)==config.textPrimitives.unWikiLink)?1:0;
  var title=w.matchText.substr(skip);
  var exists=store.tiddlerExists(title);
  var inShadow=w.tiddler && store.isShadowTiddler(w.tiddler.title);
  // check for excluded Tiddler
  if (w.tiddler && w.tiddler.isTagged(config.options.txtDisableWikiLinksTag))
   { w.outputText(w.output,w.matchStart+skip,w.nextMatch); return; }
  // check for specific excluded wiki words
  var t=store.getTiddlerText(config.options.txtDisableWikiLinksList);
  if (t && t.length && t.indexOf(w.matchText)!=-1)
   { w.outputText(w.output,w.matchStart+skip,w.nextMatch); return; }
  // if not disabling links from shadows (default setting)
  if (config.options.chkAllowLinksFromShadowTiddlers && inShadow)
   return this.coreHandler(w);
  // check for non-existing non-shadow tiddler
  if (config.options.chkDisableNonExistingWikiLinks && !exists)
   { w.outputText(w.output,w.matchStart+skip,w.nextMatch); return; }
  // if not enabled, just do standard WikiWord link formatting
  if (!config.options.chkDisableWikiLinks)
   return this.coreHandler(w);
  // just return text without linking
  w.outputText(w.output,w.matchStart+skip,w.nextMatch)
 }
}
Tiddler.prototype.coreAutoLinkWikiWords = Tiddler.prototype.autoLinkWikiWords;
Tiddler.prototype.autoLinkWikiWords = function()
{
 if (!config.options.chkDisableWikiLinks)
  return this.coreAutoLinkWikiWords.apply(this,arguments);
 return false;
}
Tiddler.prototype.disableWikiLinks_changed = Tiddler.prototype.changed;
Tiddler.prototype.changed = function()
{
 this.disableWikiLinks_changed.apply(this,arguments);
 var t=store.getTiddlerText(config.options.txtDisableWikiLinksList,"").readBracketedList();
 if (t.length) for (var i=0; i<t.length; i++)
  if (this.links.contains(t[i]))
   this.links.splice(this.links.indexOf(t[i]),1);
};
//}}}
/* |Author|Yakov Litvin|Forked from|[[abego.ForEachTiddlerPlugin|http://tiddlywiki.abego-software.de/#ForEachTiddlerPlugin]], by Udo Borkowski| */
//{{{
(function(){
// Only install once
if (version.extensions.ForEachTiddlerPlugin) {
 alert("Warning: more than one copy of ForEachTiddlerPlugin is set to be launched");
 return;
} else
 version.extensions.ForEachTiddlerPlugin = {
  source: "[repository url here]",
  licence: "[licence url here]",
  copyright: "Copyright (c) Yakov Litvin, 2012 [url of the meta page]"
 };
config.macros.forEachTiddler = {
 actions: {
  addToList: {},
  write: {}
 }
};
config.macros.forEachTiddler.handler = function(place,macroName,params,wikifier,paramString,tiddler) {
 var parsedParams = this.parseParams(params);
 if (parsedParams.errorText) {
  this.handleError(place, parsedParams.errorText);
  return;
 }//else
  parsedParams.place = place;
  parsedParams.inTiddler = tiddler? tiddler : getContainingTiddler(place);
 parsedParams.actionName = parsedParams.actionName ? parsedParams.actionName : "addToList";
 var actionName = parsedParams.actionName;
 var action = this.actions[actionName];
 if (!action) {
  this.handleError(place, "Unknown action '"+actionName+"'.");
  return;
 }
 var element = document.createElement(action.element);
 jQuery(element).attr({ refresh: "macro", macroName: macroName }).data(parsedParams);
 place.appendChild(element);
 this.refresh(element);
};
config.macros.forEachTiddler.refresh = function(element) {
 var parsedParams = jQuery(element).data(),
  action = this.actions[parsedParams.actionName];
 jQuery(element).empty();
 try {
  var tiddlersAndContext = this.getTiddlersAndContext(parsedParams);
  action.handler(element, tiddlersAndContext.tiddlers,
    parsedParams.actionParameter, tiddlersAndContext.context);
 } catch (e) {
  this.handleError(place, e);
 }
};
config.macros.forEachTiddler.getTiddlersAndContext = function(parameter) {
 var context = config.macros.forEachTiddler.createContext(parameter.place, parameter.filter, parameter.whereClause, parameter.sortClause, parameter.sortAscending, parameter.actionName, parameter.actionParameter, parameter.scriptText, parameter.tiddlyWikiPath, parameter.inTiddler);
 var tiddlyWiki = parameter.tiddlyWikiPath ? this.loadTiddlyWiki(parameter.tiddlyWikiPath) : store;
 context["tiddlyWiki"] = tiddlyWiki;
 var tiddlers = this.findTiddlers(parameter.filter, parameter.whereClause, context, tiddlyWiki);
 context["tiddlers"] = tiddlers;
 if (parameter.sortClause)
  this.sortTiddlers(tiddlers, parameter.sortClause, parameter.sortAscending, context);
 return {tiddlers: tiddlers, context: context};
};
config.macros.forEachTiddler.actions.addToList.element = "ul";
config.macros.forEachTiddler.actions.addToList.handler = function(place, tiddlers, parameter, context) {
 var p = 0;
 if (parameter.length > p) {
  config.macros.forEachTiddler.createExtraParameterErrorElement(place, "addToList", parameter, p);
  return;
 }
 for (var i = 0; i < tiddlers.length; i++) {
  var tiddler = tiddlers[i];
  var listItem = document.createElement("li");
  place.appendChild(listItem);
  createTiddlyLink(listItem, tiddler.title, true);
 }
};
var parseNamedParameter = function(name, parameter, i) {
 var beginExpression = null;
 if ((i < parameter.length) && parameter[i] == name) {
  i++;
  if (i >= parameter.length) {
   throw "Missing text behind '%0'".format([name]);
  }
  return config.macros.forEachTiddler.paramEncode(parameter[i]);
 }
 return null;
}
config.macros.forEachTiddler.actions.write.element = "span";
config.macros.forEachTiddler.actions.write.handler = function(place, tiddlers, parameter, context) {
 var p = 0;
 if (p >= parameter.length) {
  this.handleError(place, "Missing expression behind 'write'.");
  return;
 }
 var textExpression = config.macros.forEachTiddler.paramEncode(parameter[p]);
 p++;
 var beginExpression = parseNamedParameter("begin", parameter, p);
 if (beginExpression !== null)
  p += 2;
 var endExpression = parseNamedParameter("end", parameter, p);
 if (endExpression !== null)
  p += 2;
 var noneExpression = parseNamedParameter("none", parameter, p);
 if (noneExpression !== null)
  p += 2;
 var filename = null;
 var lineSeparator = undefined;
 if ((p < parameter.length) && parameter[p] == "toFile") {
  p++;
  if (p >= parameter.length) {
   this.handleError(place, "Filename expected behind 'toFile' of 'write' action.");
   return;
  }
  filename = config.macros.forEachTiddler.getLocalPath(config.macros.forEachTiddler.paramEncode(parameter[p]));
  p++;
  if ((p < parameter.length) && parameter[p] == "withLineSeparator") {
   p++;
   if (p >= parameter.length) {
    this.handleError(place, "Line separator text expected behind 'withLineSeparator' of 'write' action.");
    return;
   }
   lineSeparator = config.macros.forEachTiddler.paramEncode(parameter[p]);
   p++;
  }
 }
 if (parameter.length > p) {
  config.macros.forEachTiddler.createExtraParameterErrorElement(place, "write", parameter, p);
  return;
 }
 var func = config.macros.forEachTiddler.getEvalTiddlerFunction(textExpression, context);
 var count = tiddlers.length;
 var text = "";
 if (count > 0 && beginExpression)
  text += config.macros.forEachTiddler.getEvalTiddlerFunction(beginExpression, context)(undefined, context, count, undefined);
 for (var i = 0; i < count; i++) {
  var tiddler = tiddlers[i];
  text += func(tiddler, context, count, i);
 }
 if (count > 0 && endExpression)
  text += config.macros.forEachTiddler.getEvalTiddlerFunction(endExpression, context)(undefined, context, count, undefined);
 if (count == 0 && noneExpression)
  text += config.macros.forEachTiddler.getEvalTiddlerFunction(noneExpression, context)(undefined, context, count, undefined);
 if (filename) {
  if (lineSeparator !== undefined) {
   lineSeparator = lineSeparator.replace(/\\n/mg, "\n").replace(/\\r/mg, "\r");
   text = text.replace(/\n/mg,lineSeparator);
  }
  saveFile(filename, convertUnicodeToUTF8(text));
 } else
  wikify(text, place, null/* highlightRegExp */, context.inTiddler);
};
config.macros.forEachTiddler.parseParams = function(params) {
 var i = 0; // index running over the params
 var tiddlyWikiPath = undefined;
 if ((i < params.length) && params[i] == "in") {
  i++;
  if (i >= params.length)
   return { errorText: "TiddlyWiki path expected behind 'in'." };
  tiddlyWikiPath = this.paramEncode((i < params.length) ? params[i] : "");
  i++;
 }
 if ((i < params.length) && params[i] == "filter") {
  i++;
  var filter = (i < params.length) ? params[i] : undefined;
  i++;
 }
 var whereClause ="true";
 if ((i < params.length) && params[i] == "where") {
  i++;
  whereClause = this.paramEncode((i < params.length) ? params[i] : "");
  i++;
 }
 var sortClause = null;
 var sortAscending = true;
 if ((i < params.length) && params[i] == "sortBy") {
  i++;
  if (i >= params.length)
   return { errorText: "sortClause missing behind 'sortBy'." };
  sortClause = this.paramEncode(params[i]);
  i++;
  if ((i < params.length) && (params[i] == "ascending" || params[i] == "descending")) {
    sortAscending = params[i] == "ascending";
    i++;
  }
 }
 var scriptText = null;
 if ((i < params.length) && params[i] == "script") {
  i++;
  scriptText = this.paramEncode((i < params.length) ? params[i] : "");
  i++;
 }
 var actionName = "addToList";
 if (i < params.length) {
  if (!config.macros.forEachTiddler.actions[params[i]])
   return { errorText: "Unknown action '"+params[i]+"'." };
  else {
   actionName = params[i];
   i++;
  }
 }
 var actionParameter = params.slice(i);
 return {
   filter:   filter,
   whereClause:  whereClause,
   sortClause:  sortClause,
   sortAscending:  sortAscending,
   actionName:  actionName,
   actionParameter: actionParameter,
   scriptText:  scriptText,
   tiddlyWikiPath:  tiddlyWikiPath
  }
};
var getContainingTiddler = function(e) {
 while(e && !hasClass(e,"tiddler"))
  e = e.parentNode;
 var title = e ? e.getAttribute("tiddler") : null;
 return title ? store.getTiddler(title) : null;
};
config.macros.forEachTiddler.createContext = function(placeParam, filterParam, whereClauseParam, sortClauseParam, sortAscendingParam, actionNameParam, actionParameterParam, scriptText, tiddlyWikiPathParam, inTiddlerParam) {
 return {
  place  : placeParam,
  filter  : filterParam,
  whereClause : whereClauseParam,
  sortClause : sortClauseParam,
  sortAscending : sortAscendingParam,
  script  : scriptText,
  actionName : actionNameParam,
  actionParameter : actionParameterParam,
  tiddlyWikiPath : tiddlyWikiPathParam,
  inTiddler : inTiddlerParam, // the tiddler containing the <<forEachTiddler ...>> macro call.
  viewerTiddler : getContainingTiddler(placeParam) //the tiddler showing the forEachTiddler result
 };
};
config.macros.forEachTiddler.loadTiddlyWiki = function(path, idPrefix) {
 if (!idPrefix) {
  idPrefix = "store";
 }
 var lenPrefix = idPrefix.length;
 var content = loadFile(this.getLocalPath(path));
 if(content === null) {
  throw "TiddlyWiki '"+path+"' not found.";
 }
 var tiddlyWiki = new TiddlyWiki();
 if (!tiddlyWiki.importTiddlyWiki(content))
  throw "File '"+path+"' is not a TiddlyWiki.";
 tiddlyWiki.dirty = false;
 return tiddlyWiki;
};
config.macros.forEachTiddler.getEvalTiddlerFunction = function (javaScriptExpression, context) {
 var script = context["script"];
 var functionText = "var theFunction = function(tiddler, context, count, index) { return "+javaScriptExpression+"}";
 var fullText = (script ? script+";" : "")+functionText+";theFunction;";
 return eval(fullText);
};
config.macros.forEachTiddler.findTiddlers = function(filter, whereClause, context, tiddlyWiki) {
 var result = [];
 var func = config.macros.forEachTiddler.getEvalTiddlerFunction(whereClause, context);
 if(filter) {
  var tids = tiddlyWiki.filterTiddlers(filter);
  for(var i = 0; i < tids.length; i++)
   if(func(tids[i], context, undefined, undefined))
    result.push(tids[i]);
 } else
  tiddlyWiki.forEachTiddler(function(title,tiddler) {
   if(func(tiddler, context, undefined, undefined))
    result.push(tiddler);
  });
 return result;
};
config.macros.forEachTiddler.sortAscending = function(tiddlerA, tiddlerB) {
 return ((tiddlerA.forEachTiddlerSortValue == tiddlerB.forEachTiddlerSortValue)
   ? 0
   : ((tiddlerA.forEachTiddlerSortValue < tiddlerB.forEachTiddlerSortValue)
    ? -1
    : +1))
};
config.macros.forEachTiddler.sortDescending = function(tiddlerA, tiddlerB) {
 return ((tiddlerA.forEachTiddlerSortValue == tiddlerB.forEachTiddlerSortValue)
   ? 0
   : ((tiddlerA.forEachTiddlerSortValue < tiddlerB.forEachTiddlerSortValue)
    ? +1
    : -1))
};
config.macros.forEachTiddler.sortTiddlers = function(tiddlers, sortClause, ascending, context) {
 var func = config.macros.forEachTiddler.getEvalTiddlerFunction(sortClause, context);
 var count = tiddlers.length;
 var i;
 for (i = 0; i < count; i++) {
  var tiddler = tiddlers[i];
  tiddler.forEachTiddlerSortValue = func(tiddler,context, undefined, undefined);
 }
 tiddlers.sort(ascending ? this.sortAscending : this.sortDescending);
 for (i = 0; i < tiddlers.length; i++)
  delete tiddlers[i].forEachTiddlerSortValue;
};
config.macros.forEachTiddler.createErrorElement = function(place, exception) {
 var message = (exception.description) ? exception.description : exception.toString();
 return createTiddlyElement(place,"span",null,"forEachTiddlerError","<<forEachTiddler ...>>: "+message);
};
config.macros.forEachTiddler.handleError = function(place, exception) {
 if (place) {
  this.createErrorElement(place, exception);
 } else {
  throw exception;
 }
};
config.macros.forEachTiddler.createExtraParameterErrorElement = function(place, actionName, parameter, firstUnusedIndex) {
 var message = "Extra parameter behind '"+actionName+"':";
 for (var i = firstUnusedIndex; i < parameter.length; i++) {
  message += " "+parameter[i];
 }
 this.handleError(place, message);
};
config.macros.forEachTiddler.paramEncode = function(s) {
 var reGTGT = new RegExp("\\$\\)\\)","mg");
 var reGT = new RegExp("\\$\\)","mg");
 return s.replace(reGTGT, ">>").replace(reGT, ">");
};
config.macros.forEachTiddler.getLocalPath = function(originalPath) {
 var originalAbsolutePath = originalPath;
 if(originalAbsolutePath.search(/^((http(s)?)|(file)):/) != 0) {
  if (originalAbsolutePath.search(/^(.\:\\)|(\\\\)|(\/)/) != 0){// is relative?
   var currentUrl = document.location.toString();
   var currentPath = (currentUrl.lastIndexOf("/") > -1) ?
    currentUrl.substr(0, currentUrl.lastIndexOf("/") + 1) :
    currentUrl + "/";
   originalAbsolutePath = currentPath + originalAbsolutePath;
  } else
   originalAbsolutePath = "file://" + originalAbsolutePath;
  originalAbsolutePath = originalAbsolutePath.replace(/\\/mg,"/");
 }
 return getLocalPath(originalAbsolutePath);
};
setStylesheet(
 ".forEachTiddlerError{color: #ffffff;background-color: #880000;}",
 "forEachTiddler");
config.macros.fet = config.macros.forEachTiddler;
String.prototype.startsWith = function(prefix) {
 var n = prefix.length;
 return (this.length >= n) && (this.slice(0, n) == prefix);
};
String.prototype.endsWith = function(suffix) {
 var n = suffix.length;
 return (this.length >= n) && (this.right(n) == suffix);
};
String.prototype.contains = function(substring) {
 return this.indexOf(substring) >= 0;
};
})();
Tiddler.prototype.getSlice = function(sliceName,defaultText) {
 var re = TiddlyWiki.prototype.slicesRE;
 re.lastIndex = 0;
 var m = re.exec(this.text);
 while(m) {
  if(m[2]) {
   if(m[2] == sliceName)
    return m[3];
  } else {
   if(m[5] == sliceName)
    return m[6];
  }
  m = re.exec(this.text);
 }
 return defaultText;
};
Tiddler.prototype.getSection = function(sectionName,defaultText) {
 var beginSectionRegExp = new RegExp("(^!{1,6}[ \t]*" + sectionName.escapeRegExp() + "[ \t]*\n)","mg"),
  sectionTerminatorRegExp = /^!/mg;
 var match = beginSectionRegExp.exec(this.text), sectionText;
 if(match) {
  sectionText = this.text.substr(match.index+match[1].length);
  match = sectionTerminatorRegExp.exec(sectionText);
  if(match)
   sectionText = sectionText.substr(0,match.index-1); // don't include final \n
  return sectionText
 }
 return defaultText;
};
//}}}
/* |Author|SaqImtiaz|Version|1.11| */
//{{{
config.hoverMenu={};
config.hoverMenu.settings={ align: 'right', x: 4, y: 100 };
config.hoverMenu.handler=function()
{
  var theMenu = createTiddlyElement(document.getElementById("contentWrapper"), "div","hoverMenu");
  theMenu.setAttribute("refresh","content");
  theMenu.setAttribute("tiddler","HoverMenu");
  var menuContent = store.getTiddlerText("HoverMenu");
  wikify(menuContent,theMenu);
        var Xloc = this.settings.x;
        Yloc =this.settings.y;
        var ns = (navigator.appName.indexOf("Netscape") != -1);
        function SetMenu(id)
   {
   var GetElements=document.getElementById?document.getElementById(id):document.all?document.all[id]:document.layers[id];
   if(document.layers)GetElements.style=GetElements;
   GetElements.sP=function(x,y){this.style[config.hoverMenu.settings.align]=x +"px";this.style.top=y +"px";};
   GetElements.x = Xloc;
   GetElements.y = findScrollY();
   GetElements.y += Yloc;
   return GetElements;
   }
  window.LoCate_XY=function()
   {
   var pY =  findScrollY();
   ftlObj.y += (pY + Yloc - ftlObj.y)/15;
   ftlObj.sP(ftlObj.x, ftlObj.y);
   setTimeout("LoCate_XY()", 10);
   }
  ftlObj = SetMenu("hoverMenu");
   LoCate_XY();
};
window.old_lewcid_hovermenu_restart = restart;
restart = function()
{
  window.old_lewcid_hovermenu_restart();
  config.hoverMenu.handler();
};
setStylesheet(
"#hoverMenu .button, #hoverMenu .tiddlyLink {border:none; background:#008; color:#fff; padding:0 20px; float:right; margin-bottom:5px;}\sn"+
"#hoverMenu .button:hover, #hoverMenu .tiddlyLink:hover {border:none; color:#fff; background:#00f; padding:0 20px; float:right; margin-bottom:5px;}\sn"+
"#hoverMenu .button {width:100%; text-align:center}"+
"#hoverMenu { position:absolute; width:10px;}\sn"+
"\sn","hoverMenuStyles");
config.macros.renameButton={};
config.macros.renameButton.handler = function(place,macroName,params,wikifier,paramString,tiddler)
{
  if (place.lastChild.tagName!="BR")
       {
  place.lastChild.firstChild.data = params[0];
  if (params[1]) {place.lastChild.title = params[1];}
       }
};
config.shadowTiddlers["HoverMenu"]="<<top>><<jump ≡→ '' top>>[[CCM]]^^[[CCSK]]^^^^[[CAIQ]]^^";
config.macros.top={};
config.macros.top.handler=function(place,macroName)
{ createTiddlyButton(place,"→↑↑","↑ Haut de page ↑",this.onclick); }
config.macros.top.onclick=function()
{ window.scrollTo(0,0); };
config.commands.top =
{ text:" ^ ", tooltip:"^ Haut de page ^" };
config.commands.top.handler = function(event,src,title)
{ window.scrollTo(0,0); }

config.macros.jump= {};
config.macros.jump.handler = function (place,macroName,params,wikifier,paramString,tiddler)
{
 var label = (params[0] && params[0]!=".")? params[0]: 'jump';
 var tooltip = (params[1] && params[1]!=".")? params[1]: '→ Aller vers un article déjà ouvert';
 var top = (params[2] && params[2]=='top') ? true: false;
 var btn =createTiddlyButton(place,label,tooltip,this.onclick);
 if (top==true)
       btn.setAttribute("top","true")
}
config.macros.jump.onclick = function(e)
{
 if (!e) var e = window.event;
 var theTarget = resolveTarget(e);
 var top = theTarget.getAttribute("top");
 var popup = Popup.create(this);
 if(popup)
  {
   if(top=="true")
    {createTiddlyButton(createTiddlyElement(popup,"li"),'↑ Tout en Haut ↑','→ Aller tout en haut de cette page',config.macros.jump.top);
     createTiddlyElement(popup,"hr");}

  story.forEachTiddler(function(title,element) {
   createTiddlyLink(createTiddlyElement(popup,"li"),title,true);
   });
  }
 Popup.show(popup,false);
 e.cancelBubble = true;
 if (e.stopPropagation) e.stopPropagation();
 return false;
}
config.macros.jump.top = function()
{
       window.scrollTo(0,0);
}

Popup.show = function(unused,slowly)
{
var curr = Popup.stack[Popup.stack.length-1];
 var rootLeft = findPosX(curr.root);
 var rootTop = findPosY(curr.root);
 var rootHeight = curr.root.offsetHeight;
 var popupLeft = rootLeft;
 var popupTop = rootTop + rootHeight;
 var popupWidth = curr.popup.offsetWidth;
 var winWidth = findWindowWidth();
 if (isChild(curr.root,'hoverMenu'))
       var x = config.hoverMenu.settings.x;
 else
       var x = 0;
 if(popupLeft + popupWidth+x > winWidth)
  popupLeft = winWidth - popupWidth -x;
 if (isChild(curr.root,'hoverMenu'))
    {curr.popup.style.right = x + "px";}
 else
  curr.popup.style.left = popupLeft + "px";
 curr.popup.style.top = popupTop + "px";
 curr.popup.style.display = "block";
 addClass(curr.root,"highlight");
 if(config.options.chkAnimate)
  anim.startAnimating(new Scroller(curr.popup,slowly));
 else
  window.scrollTo(0,ensureVisible(curr.popup));
}
window.isChild = function(e,parentId) {
 while (e != null) {
  var parent = document.getElementById(parentId);
  if (parent == e) return true;
  e = e.parentNode;
  }
 return false;
};
//}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
!Configuration
<<<
Use {{{<hide linebreaks>}}} within HTML content to wiki-style rendering of line breaks. To //always// omit all line breaks from the rendered output, you can set this option:
><<option chkHTMLHideLinebreaks>> ignore all line breaks
which can also be 'hard coded' into your document by adding the following to a tiddler, tagged with <<tag systemConfig>>
>{{{config.options.chkHTMLHideLinebreaks=true;}}}
<<<
!Code
*/
//{{{
version.extensions.HTMLFormattingPlugin= {major: 2, minor: 4, revision: 1, date: new Date(2010,5,7)};
// find the formatter for HTML and replace the handler
initHTMLFormatter();
function initHTMLFormatter()
{
 for (var i=0; i<config.formatters.length && config.formatters[i].name!="html"; i++);
 if (i<config.formatters.length) config.formatters[i].handler=function(w) {
  if (!this.lookaheadRegExp)
   this.lookaheadRegExp = new RegExp(this.lookahead,"mg");
  this.lookaheadRegExp.lastIndex = w.matchStart;
  var lookaheadMatch = this.lookaheadRegExp.exec(w.source)
  if(lookaheadMatch && lookaheadMatch.index == w.matchStart) {
   var html=lookaheadMatch[1];
   // if <nowiki> is present, just let browser handle it!
   if (html.indexOf('<nowiki>')!=-1)
    createTiddlyElement(w.output,"span").innerHTML=html;
   else {
    // if <hide linebreaks> is present, or chkHTMLHideLinebreaks is set
    // suppress wiki-style literal handling of newlines
    if (config.options.chkHTMLHideLinebreaks||(html.indexOf('<hide linebreaks>')!=-1))
     html=html.replace(/\n/g,' ');
    // remove all \r's added by IE textarea and mask newlines and macro brackets
    html=html.replace(/\r/g,'').replace(/\n/g,'\\n').replace(/<</g,'%%(').replace(/>>/g,')%%');
    // create span, let browser parse HTML
    var e=createTiddlyElement(w.output,"span"); e.innerHTML=html;
    // then re-render text nodes as wiki-formatted content
    wikifyTextNodes(e,w);
   }
   w.nextMatch = this.lookaheadRegExp.lastIndex; // continue parsing
  }
 }
}
// wikify #text nodes that remain after HTML content is processed (pre-order recursion)
function wikifyTextNodes(theNode,w)
{
 function unmask(s) { return s.replace(/\%%\(/g,'<<').replace(/\)\%%/g,'>>').replace(/\\n/g,'\n'); }
 switch (theNode.nodeName.toLowerCase()) {
  case 'style': case 'option': case 'select':
   theNode.innerHTML=unmask(theNode.innerHTML);
   break;
  case 'textarea':
   theNode.value=unmask(theNode.value);
   break;
  case '#text':
   var txt=unmask(theNode.nodeValue);
   var newNode=createTiddlyElement(null,"span");
   theNode.parentNode.replaceChild(newNode,theNode);
   wikify(txt,newNode,highlightHack,w.tiddler);
   break;
  default:
   for (var i=0;i<theNode.childNodes.length;i++)
    wikifyTextNodes(theNode.childNodes.item(i),w); // recursion
   break;
 }
}
//}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
!Code
*/
//{{{
version.extensions.ImageSizePlugin= {major: 1, minor: 2, revision: 2, date: new Date(2010,7,24)};
//}}}
//{{{
var f=config.formatters[config.formatters.findByField("name","image")];
f.match="\\[[<>]?[Ii][Mm][Gg](?:\\([^,]*,[^\\)]*\\))?\\[";
f.lookaheadRegExp=/\[([<]?)(>?)[Ii][Mm][Gg](?:\(([^,]*),([^\)]*)\))?\[(?:([^\|\]]+)\|)?([^\[\]\|]+)\](?:\[([^\]]*)\])?\]/mg;
f.handler=function(w) {
 this.lookaheadRegExp.lastIndex = w.matchStart;
 var lookaheadMatch = this.lookaheadRegExp.exec(w.source)
 if(lookaheadMatch && lookaheadMatch.index == w.matchStart) {
  var floatLeft=lookaheadMatch[1];
  var floatRight=lookaheadMatch[2];
  var width=lookaheadMatch[3];
  var height=lookaheadMatch[4];
  var tooltip=lookaheadMatch[5];
  var src=lookaheadMatch[6];
  var link=lookaheadMatch[7];
  var e = w.output;
  if(link) { // LINKED IMAGE
   if (config.formatterHelpers.isExternalLink(link)) {
    if (config.macros.attach && config.macros.attach.isAttachment(link)) {
     // see [[AttachFilePluginFormatters]]
     e = createExternalLink(w.output,link);
     e.href=config.macros.attach.getAttachment(link);
     e.title = config.macros.attach.linkTooltip + link;
    } else
     e = createExternalLink(w.output,link);
   } else
    e = createTiddlyLink(w.output,link,false,null,w.isStatic);
   addClass(e,"imageLink");
  }
  var img = createTiddlyElement(e,"img");
  if(floatLeft) img.align="left"; else if(floatRight) img.align="right";
  if(width||height) {
   var x=width.trim(); var y=height.trim();
   var stretchW=(x.substr(x.length-1,1)=='+'); if (stretchW) x=x.substr(0,x.length-1);
   var stretchH=(y.substr(y.length-1,1)=='+'); if (stretchH) y=y.substr(0,y.length-1);
   if (x.substr(0,2)=="{{")
    { try{x=eval(x.substr(2,x.length-4))} catch(e){displayMessage(e.description||e.toString())} }
   if (y.substr(0,2)=="{{")
    { try{y=eval(y.substr(2,y.length-4))} catch(e){displayMessage(e.description||e.toString())} }
   img.style.width=x.trim(); img.style.height=y.trim();
   config.formatterHelpers.addStretchHandlers(img,stretchW,stretchH);
  }
  if(tooltip) img.title = tooltip;
  if (config.macros.attach && config.macros.attach.isAttachment(src))
   src=config.macros.attach.getAttachment(src); // see [[AttachFilePluginFormatters]]
  else if (config.formatterHelpers.resolvePath) { // see [[ImagePathPlugin]]
   if (config.browser.isIE || config.browser.isSafari) {
    img.onerror=(function(){
     this.src=config.formatterHelpers.resolvePath(this.src,false);
     return false;
    });
   } else
    src=config.formatterHelpers.resolvePath(src,true);
  }
  img.src=src;
  w.nextMatch = this.lookaheadRegExp.lastIndex;
 }
}
config.formatterHelpers.imageSize={
tip: '', dragtip: 'DRAG=étirer/réduire, '
}
config.formatterHelpers.addStretchHandlers=function(e,stretchW,stretchH) {
 e.title=((stretchW||stretchH)?this.imageSize.dragtip:'')+this.imageSize.tip;
 e.statusMsg='width=%0, height=%1';
 e.style.cursor='move';
 e.originalW=e.style.width;
 e.originalH=e.style.height;
 e.minW=Math.max(e.offsetWidth/20,10);
 e.minH=Math.max(e.offsetHeight/20,10);
 e.stretchW=stretchW;
 e.stretchH=stretchH;
 e.onmousedown=function(ev) { var ev=ev||window.event;
  this.sizing=true;
  this.startX=!config.browser.isIE?ev.pageX:(ev.clientX+findScrollX());
  this.startY=!config.browser.isIE?ev.pageY:(ev.clientY+findScrollY());
  this.startW=this.offsetWidth;
  this.startH=this.offsetHeight;
  return false;
 };
 e.onmousemove=function(ev) { var ev=ev||window.event;
  if (this.sizing) {
   var s=this.style;
   var currX=!config.browser.isIE?ev.pageX:(ev.clientX+findScrollX());
   var currY=!config.browser.isIE?ev.pageY:(ev.clientY+findScrollY());
   var newW=(currX-this.offsetLeft)/(this.startX-this.offsetLeft)*this.startW;
   var newH=(currY-this.offsetTop )/(this.startY-this.offsetTop )*this.startH;
   if (this.stretchW) s.width =Math.floor(Math.max(newW,this.minW))+'px';
   if (this.stretchH) s.height=Math.floor(Math.max(newH,this.minH))+'px';
   clearMessage(); displayMessage(this.statusMsg.format([s.width,s.height]));
  }
  return false;
 };
 e.onmouseup=function(ev) { var ev=ev||window.event;
  if (ev.shiftKey) { this.style.width=this.style.height=''; }
  if (ev.ctrlKey) { this.style.width=this.originalW; this.style.height=this.originalH; }
  this.sizing=false;
  clearMessage();
  return false;
 };
 e.onmouseout=function(ev) { var ev=ev||window.event;
  this.sizing=false;
  clearMessage();
  return false;
 };
}
//}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|!Code
*/
//{{{
version.extensions.InlineJavascriptPlugin= {major: 1, minor: 9, revision: 6, date: new Date(2010,12,15)};
config.formatters.push( {
 name: "inlineJavascript",
 match: "\\<script",
 lookahead: "\\<script(?: type=\\\"[^\\\"]*\\\")?(?: src=\\\"([^\\\"]*)\\\")?(?: label=\\\"([^\\\"]*)\\\")?(?: title=\\\"([^\\\"]*)\\\")?(?: key=\\\"([^\\\"]*)\\\")?( show)?\\>((?:.|\\n)*?)\\</script\\>",
 handler: function(w) {
  var lookaheadRegExp = new RegExp(this.lookahead,"mg");
  lookaheadRegExp.lastIndex = w.matchStart;
  var lookaheadMatch = lookaheadRegExp.exec(w.source)
  if(lookaheadMatch && lookaheadMatch.index == w.matchStart) {
   var src=lookaheadMatch[1];
   var label=lookaheadMatch[2];
   var tip=lookaheadMatch[3];
   var key=lookaheadMatch[4];
   var show=lookaheadMatch[5];
   var code=lookaheadMatch[6];
   if (src) { // external script library
    var script = document.createElement("script"); script.src = src;
    document.body.appendChild(script); document.body.removeChild(script);
   }
   if (code) { // inline code
    if (show) // display source in tiddler
     wikify("{{{\n"+lookaheadMatch[0]+"\n}}}\n",w.output);
    if (label) { // create 'onclick' command link
     var link=createTiddlyElement(w.output,"a",null,"tiddlyLinkExisting",wikifyPlainText(label));
     var fixup=code.replace(/document.write\s*\(/gi,'place.bufferedHTML+=(');
     link.code="function _out(place,tiddler){"+fixup+"\n};_out(this,this.tiddler);"
     link.tiddler=w.tiddler;
     link.onclick=function(){
      this.bufferedHTML="";
      try{ var r=eval(this.code);
       if(this.bufferedHTML.length || (typeof(r)==="string")&&r.length)
        var s=this.parentNode.insertBefore(document.createElement("span"),this.nextSibling);
       if(this.bufferedHTML.length)
        s.innerHTML=this.bufferedHTML;
       if((typeof(r)==="string")&&r.length) {
        wikify(r,s,null,this.tiddler);
        return false;
       } else return r!==undefined?r:false;
      } catch(e){alert(e.description||e.toString());return false;}
     };
     link.setAttribute("title",tip||"");
     var URIcode='javascript:void(eval(decodeURIComponent(%22(function(){try{';
     URIcode+=encodeURIComponent(encodeURIComponent(code.replace(/\n/g,' ')));
     URIcode+='}catch(e){alert(e.description||e.toString())}})()%22)))';
     link.setAttribute("href",URIcode);
     link.style.cursor="pointer";
     if (key) link.accessKey=key.substr(0,1); // single character only
    }
    else { // run script immediately
     var fixup=code.replace(/document.write\s*\(/gi,'place.innerHTML+=(');
     var c="function _out(place,tiddler){"+fixup+"\n};_out(w.output,w.tiddler);";
     try  { var out=eval(c); }
     catch(e) { out=e.description?e.description:e.toString(); }
     if (out && out.length) wikify(out,w.output,w.highlightRegExp,w.tiddler);
    }
   }
   w.nextMatch = lookaheadMatch.index + lookaheadMatch[0].length;
  }
 }
} )
//}}}
// // Backward-compatibility for TW2.1.x and earlier
//{{{
if (typeof(wikifyPlainText)=="undefined") window.wikifyPlainText=function(text,limit,tiddler) {
 if(limit > 0) text = text.substr(0,limit);
 var wikifier = new Wikifier(text,formatter,null,tiddler);
 return wikifier.wikifyPlain();
}
//}}}
// // GLOBAL FUNCTION: $(...) -- 'shorthand' convenience syntax for document.getElementById()
//{{{
if (typeof($)=='undefined') { function $(id) { return document.getElementById(id.replace(/^#/,'')); } }
//}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
!Configuration
<<<
<<option chkFloatingSlidersAnimate>> allow floating sliders to animate when opening/closing
<<<
!Code
*/
//{{{
version.extensions.NestedSlidersPlugin= {major: 2, minor: 4, revision: 9, date: new Date(2008,11,15)};
// options for deferred rendering of sliders that are not initially displayed
if (config.options.chkFloatingSlidersAnimate===undefined)
 config.options.chkFloatingSlidersAnimate=false; // avoid clipping problems in IE
// default styles for 'floating' class
setStylesheet(".floatingPanel { position:absolute; z-index:10; padding:0.5em; margin:0em; \
 background-color:#eee; color:#000; border:1px solid #000; text-align:left; }","floatingPanelStylesheet");
// if removeCookie() function is not defined by TW core, define it here.
if (window.removeCookie===undefined) {
 window.removeCookie=function(name) {
  document.cookie = name+'=; expires=Thu, 01-Jan-1970 00:00:01 UTC; path=/;';
 }
}
config.formatters.push( {
 name: "nestedSliders",
 match: "\\n?\\+{3}",
 terminator: "\\s*\\={3}\\n?",
 lookahead: "\\n?\\+{3}(\\+)?(\\([^\\)]*\\))?(\\!*)?(\\^(?:[^\\^\\*\\@\\[\\>]*\\^)?)?(\\*)?(\\@)?(?:\\{\\{([\\w]+[\\s\\w]*)\\{)?(\\[[^\\]]*\\])?(\\[[^\\]]*\\])?(?:\\}{3})?(\\#[^:]*\\:)?(\\>)?(\\.\\.\\.)?\\s*",
 handler: function(w)
  {
   lookaheadRegExp = new RegExp(this.lookahead,"mg");
   lookaheadRegExp.lastIndex = w.matchStart;
   var lookaheadMatch = lookaheadRegExp.exec(w.source)
   if(lookaheadMatch && lookaheadMatch.index == w.matchStart)
   {
    var defopen=lookaheadMatch[1];
    var cookiename=lookaheadMatch[2];
    var header=lookaheadMatch[3];
    var panelwidth=lookaheadMatch[4];
    var transient=lookaheadMatch[5];
    var hover=lookaheadMatch[6];
    var buttonClass=lookaheadMatch[7];
    var label=lookaheadMatch[8];
    var openlabel=lookaheadMatch[9];
    var panelID=lookaheadMatch[10];
    var blockquote=lookaheadMatch[11];
    var deferred=lookaheadMatch[12];
    // location for rendering button and panel
    var place=w.output;
    // default to closed, no cookie, no accesskey, no alternate text/tip
    var show="none"; var cookie=""; var key="";
    var closedtext=">"; var closedtip="";
    var openedtext="<"; var openedtip="";
    // extra "+", default to open
    if (defopen) show="block";
    // cookie, use saved open/closed state
    if (cookiename) {
     cookie=cookiename.trim().slice(1,-1);
     cookie="chkSlider"+cookie;
     if (config.options[cookie]==undefined)
      { config.options[cookie] = (show=="block") }
     show=config.options[cookie]?"block":"none";
    }
    // parse label/tooltip/accesskey: [label=X|tooltip]
    if (label) {
     var parts=label.trim().slice(1,-1).split("|");
     closedtext=parts.shift();
     if (closedtext.substr(closedtext.length-2,1)=="=")
      { key=closedtext.substr(closedtext.length-1,1); closedtext=closedtext.slice(0,-2); }
     openedtext=closedtext;
     if (parts.length) closedtip=openedtip=parts.join("|");
     else { closedtip="show "+closedtext; openedtip="hide "+closedtext; }
    }
    // parse alternate label/tooltip: [label|tooltip]
    if (openlabel) {
     var parts=openlabel.trim().slice(1,-1).split("|");
     openedtext=parts.shift();
     if (parts.length) openedtip=parts.join("|");
     else openedtip="hide "+openedtext;
    }
    var title=show=='block'?openedtext:closedtext;
    var tooltip=show=='block'?openedtip:closedtip;
    // create the button
    if (header) { // use "Hn" header format instead of button/link
     var lvl=(header.length>5)?5:header.length;
     var btn = createTiddlyElement(createTiddlyElement(place,"h"+lvl,null,null,null),"a",null,buttonClass,title);
     btn.onclick=onClickNestedSlider;
     btn.setAttribute("href","javascript:;");
     btn.setAttribute("title",tooltip);
    }
    else
     var btn = createTiddlyButton(place,title,tooltip,onClickNestedSlider,buttonClass);
    btn.innerHTML=title; // enables use of HTML entities in label
    // set extra button attributes
    btn.setAttribute("closedtext",closedtext);
    btn.setAttribute("closedtip",closedtip);
    btn.setAttribute("openedtext",openedtext);
    btn.setAttribute("openedtip",openedtip);
    btn.sliderCookie = cookie; // save the cookiename (if any) in the button object
    btn.defOpen=defopen!=null; // save default open/closed state (boolean)
    btn.keyparam=key; // save the access key letter ("" if none)
    if (key.length) {
     btn.setAttribute("accessKey",key); // init access key
     btn.onfocus=function(){this.setAttribute("accessKey",this.keyparam);}; // **reclaim** access key on focus
    }
    btn.setAttribute("hover",hover?"true":"false");
    btn.onmouseover=function(ev) {
     // optional 'open on hover' handling
     if (this.getAttribute("hover")=="true" && this.sliderPanel.style.display=='none') {
      document.onclick.call(document,ev); // close transients
      onClickNestedSlider(ev); // open this slider
     }
     // mouseover on button aligns floater position with button
     if (window.adjustSliderPos) window.adjustSliderPos(this.parentNode,this,this.sliderPanel);
    }
    // create slider panel
    var panelClass=panelwidth?"floatingPanel":"sliderPanel";
    if (panelID) panelID=panelID.slice(1,-1); // trim off delimiters
    var panel=createTiddlyElement(place,"div",panelID,panelClass,null);
    panel.button = btn; // so the slider panel know which button it belongs to
    btn.sliderPanel=panel; // so the button knows which slider panel it belongs to
    panel.defaultPanelWidth=(panelwidth && panelwidth.length>2)?panelwidth.slice(1,-1):"";
    panel.setAttribute("transient",transient=="*"?"true":"false");
    panel.style.display = show;
    panel.style.width=panel.defaultPanelWidth;
    panel.onmouseover=function(event) // mouseover on panel aligns floater position with button
     { if (window.adjustSliderPos) window.adjustSliderPos(this.parentNode,this.button,this); }
    // render slider (or defer until shown)
    w.nextMatch = lookaheadMatch.index + lookaheadMatch[0].length;
    if ((show=="block")||!deferred) {
     // render now if panel is supposed to be shown or NOT deferred rendering
     w.subWikify(blockquote?createTiddlyElement(panel,"blockquote"):panel,this.terminator);
     // align floater position with button
     if (window.adjustSliderPos) window.adjustSliderPos(place,btn,panel);
    }
    else {
     var src = w.source.substr(w.nextMatch);
     var endpos=findMatchingDelimiter(src,"+++","===");
     panel.setAttribute("raw",src.substr(0,endpos));
     panel.setAttribute("blockquote",blockquote?"true":"false");
     panel.setAttribute("rendered","false");
     w.nextMatch += endpos+3;
     if (w.source.substr(w.nextMatch,1)=="\n") w.nextMatch++;
    }
   }
  }
 }
)
function findMatchingDelimiter(src,starttext,endtext) {
 var startpos = 0;
 var endpos = src.indexOf(endtext);
 // check for nested delimiters
 while (src.substring(startpos,endpos-1).indexOf(starttext)!=-1) {
  // count number of nested 'starts'
  var startcount=0;
  var temp = src.substring(startpos,endpos-1);
  var pos=temp.indexOf(starttext);
  while (pos!=-1) { startcount++; pos=temp.indexOf(starttext,pos+starttext.length); }
  // set up to check for additional 'starts' after adjusting endpos
  startpos=endpos+endtext.length;
  // find endpos for corresponding number of matching 'ends'
  while (startcount && endpos!=-1) {
   endpos = src.indexOf(endtext,endpos+endtext.length);
   startcount--;
  }
 }
 return (endpos==-1)?src.length:endpos;
}
//}}}
//{{{
window.onClickNestedSlider=function(e)
{
 if (!e) var e = window.event;
 var theTarget = resolveTarget(e);
 while (theTarget && theTarget.sliderPanel==undefined) theTarget=theTarget.parentNode;
 if (!theTarget) return false;
 var theSlider = theTarget.sliderPanel;
 var isOpen = theSlider.style.display!="none";
 // if SHIFT-CLICK, dock panel first (see [[MoveablePanelPlugin]])
 if (e.shiftKey && config.macros.moveablePanel) config.macros.moveablePanel.dock(theSlider,e);
 // toggle label
 theTarget.innerHTML=isOpen?theTarget.getAttribute("closedText"):theTarget.getAttribute("openedText");
 // toggle tooltip
 theTarget.setAttribute("title",isOpen?theTarget.getAttribute("closedTip"):theTarget.getAttribute("openedTip"));
 // deferred rendering (if needed)
 if (theSlider.getAttribute("rendered")=="false") {
  var place=theSlider;
  if (theSlider.getAttribute("blockquote")=="true")
   place=createTiddlyElement(place,"blockquote");
  wikify(theSlider.getAttribute("raw"),place);
  theSlider.setAttribute("rendered","true");
 }
 // show/hide the slider
 if(config.options.chkAnimate && (!hasClass(theSlider,'floatingPanel') || config.options.chkFloatingSlidersAnimate))
  anim.startAnimating(new Slider(theSlider,!isOpen,e.shiftKey || e.altKey,"none"));
 else
  theSlider.style.display = isOpen ? "none" : "block";
 // reset to default width (might have been changed via plugin code)
 theSlider.style.width=theSlider.defaultPanelWidth;
 // align floater panel position with target button
 if (!isOpen && window.adjustSliderPos) window.adjustSliderPos(theSlider.parentNode,theTarget,theSlider);
 // if showing panel, set focus to first 'focus-able' element in panel
 if (theSlider.style.display!="none") {
  var ctrls=theSlider.getElementsByTagName("*");
  for (var c=0; c<ctrls.length; c++) {
   var t=ctrls[c].tagName.toLowerCase();
   if ((t=="input" && ctrls[c].type!="hidden") || t=="textarea" || t=="select")
    { try{ ctrls[c].focus(); } catch(err){;} break; }
  }
 }
 var cookie=theTarget.sliderCookie;
 if (cookie && cookie.length) {
  config.options[cookie]=!isOpen;
  if (config.options[cookie]!=theTarget.defOpen) window.saveOptionCookie(cookie);
  else window.removeCookie(cookie); // remove cookie if slider is in default display state
 }
 // prevent SHIFT-CLICK from being processed by browser (opens blank window... yuck!)
 // prevent clicks *within* a slider button from being processed by browser
 // but allow plain click to bubble up to page background (to close transients, if any)
 if (e.shiftKey || theTarget!=resolveTarget(e))
  { e.cancelBubble=true; if (e.stopPropagation) e.stopPropagation(); }
 Popup.remove(); // close open popup (if any)
 return false;
}
//}}}
//{{{
// click in document background closes transient panels
document.nestedSliders_savedOnClick=document.onclick;
document.onclick=function(ev) { if (!ev) var ev=window.event; var target=resolveTarget(ev);
 if (document.nestedSliders_savedOnClick)
  var retval=document.nestedSliders_savedOnClick.apply(this,arguments);
 // if click was inside a popup... leave transient panels alone
 var p=target; while (p) if (hasClass(p,"popup")) break; else p=p.parentNode;
 if (p) return retval;
 // if click was inside transient panel (or something contained by a transient panel), leave it alone
 var p=target; while (p) {
  if ((hasClass(p,"floatingPanel")||hasClass(p,"sliderPanel"))&&p.getAttribute("transient")=="true") break;
  p=p.parentNode;
 }
 if (p) return retval;
 // otherwise, find and close all transient panels...
 var all=document.all?document.all:document.getElementsByTagName("DIV");
 for (var i=0; i<all.length; i++) {
   // if it is not a transient panel, or the click was on the button that opened this panel, don't close it.
  if (all[i].getAttribute("transient")!="true" || all[i].button==target) continue;
  // otherwise, if the panel is currently visible, close it by clicking it's button
  if (all[i].style.display!="none") window.onClickNestedSlider({target:all[i].button})
  if (!hasClass(all[i],"floatingPanel")&&!hasClass(all[i],"sliderPanel")) all[i].style.display="none";
 }
 return retval;
};
//}}}
//{{{
// adjust floating panel position based on button position
if (window.adjustSliderPos==undefined) window.adjustSliderPos=function(place,btn,panel) {
 if (hasClass(panel,"floatingPanel") && !hasClass(panel,"undocked")) {
  // see [[MoveablePanelPlugin]] for use of 'undocked'
  var rightEdge=document.body.offsetWidth-1;
  var panelWidth=panel.offsetWidth;
  var left=0;
  var top=btn.offsetHeight;
  if (place.style.position=="relative" && findPosX(btn)+panelWidth>rightEdge) {
   left-=findPosX(btn)+panelWidth-rightEdge; // shift panel relative to button
   if (findPosX(btn)+left<0) left=-findPosX(btn); // stay within left edge
  }
  if (place.style.position!="relative") {
   var left=findPosX(btn);
   var top=findPosY(btn)+btn.offsetHeight;
   var p=place; while (p && !hasClass(p,'floatingPanel')) p=p.parentNode;
   if (p) { left-=findPosX(p); top-=findPosY(p); }
   if (left+panelWidth>rightEdge) left=rightEdge-panelWidth;
   if (left<0) left=0;
  }
  panel.style.left=left+"px"; panel.style.top=top+"px";
 }
}
//}}}
//{{{
// TW2.1 and earlier:
// hijack Slider stop handler so overflow is visible after animation has completed
Slider.prototype.coreStop = Slider.prototype.stop;
Slider.prototype.stop = function()
 { this.coreStop.apply(this,arguments); this.element.style.overflow = "visible"; }
// TW2.2+
// hijack Morpher stop handler so sliderPanel/floatingPanel overflow is visible after animation has completed
if (version.major+.1*version.minor+.01*version.revision>=2.2) {
 Morpher.prototype.coreStop = Morpher.prototype.stop;
 Morpher.prototype.stop = function() {
  this.coreStop.apply(this,arguments);
  var e=this.element;
  if (hasClass(e,"sliderPanel")||hasClass(e,"floatingPanel")) {
   // adjust panel overflow and position after animation
   e.style.overflow = "visible";
   if (window.adjustSliderPos) window.adjustSliderPos(e.parentNode,e.button,e);
  }
 };
}
//}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
*/
//{{{
version.extensions.QuoteOfTheDayPlugin= {major: 1, minor: 4, revision: 1, date: new Date(2008,3,21)};
config.macros.QOTD = {
 clickTooltip: "click to view another item",
 timerTooltip: "auto-timer stopped... 'mouseout' to restart timer",
 timerClickTooltip: "auto-timer stopped... click to view another item, or 'mouseout' to restart timer",
 handler:
 function(place,macroName,params) {
 var tid=params.shift(); // source tiddler containing HR-separated quotes
 var p=params.shift();
 var click=true; // allow click for next item
 var inline=false; // wrap in slider for animation effect
 var random=true; // pick an item at random (default for "quote of the day" usage)
 var folder=false; // use local filesystem folder list
 var cookie=""; // default to no cookie
 var next=0; // default to first item (or random item)
 while (p) {
 if (p.toLowerCase()=="noclick") var click=false;
 if (p.toLowerCase()=="inline") var inline=true;
 if (p.toLowerCase()=="norandom") var random=false;
 if (p.toLowerCase().substr(0,7)=="cookie:") var cookie=p.substr(8);
 if (!isNaN(p)) var delay=p;
 p=params.shift();
 }
 if ((click||delay) && !inline) {
 var panel = createTiddlyElement(null,"div",null,"sliderPanel");
 panel.style.display="none";
 place.appendChild(panel);
 var here=createTiddlyElement(panel,click?"a":"span",null,"QOTD");
 }
 else
 var here=createTiddlyElement(place,click?"a":"span",null,"QOTD");
 here.id=(new Date()).convertToYYYYMMDDHHMMSSMMM()+Math.random().toString(); // unique ID
 // get items from tiddler or file list
 var list=store.getTiddlerText(tid,"");
 if (!list||!list.length) { // not a tiddler... maybe an image directory?
 var list=this.getImageFileList(tid);
 if (!list.length) { // maybe relative path... fixup and try again
 var h=document.location.href;
 var p=getLocalPath(decodeURIComponent(h.substr(0,h.lastIndexOf("/")+1)));
 var list=this.getImageFileList(p+tid);
 }
 }
 if (!list||!list.length) return false; // no contents... nothing to display!
 here.setAttribute("list",list);
 if (delay) here.setAttribute("delay",delay);
 here.setAttribute("random",random);
 here.setAttribute("cookie",cookie);
 if (click) {
 here.title=this.clickTooltip
 if (!inline) here.style.display="block";
 here.setAttribute("href","javascript:;");
 here.onclick=function(event)
 { config.macros.QOTD.showNextItem(this); }
 }
 if (config.options["txtQOTD_"+cookie]!=undefined) next=parseInt(config.options["txtQOTD_"+cookie]);
 here.setAttribute("nextItem",next);
 config.macros.QOTD.showNextItem(here);
 if (delay) {
 here.title=click?this.timerClickTooltip:this.timerTooltip
 here.onmouseover=function(event)
 { clearTimeout(this.ticker); };
 here.onmouseout=function(event)
 { this.ticker=setTimeout("config.macros.QOTD.tick('"+this.id+"')",this.getAttribute("delay")); };
 here.ticker=setTimeout("config.macros.QOTD.tick('"+here.id+"')",delay);
 }
 },
 tick: function(id) {
 var here=document.getElementById(id); if (!here) return;
 config.macros.QOTD.showNextItem(here);
 here.ticker=setTimeout("config.macros.QOTD.tick('"+id+"')",here.getAttribute("delay"));
 },
 showNextItem:
 function (here) {
 // hide containing slider panel (if any)
 var p=here.parentNode;
 if (p.className=="sliderPanel") p.style.display = "none"
 // get a new quote
 var index=here.getAttribute("nextItem");
 var items=here.getAttribute("list").split("\n----\n");
 if (index<0||index>=items.length) index=0;
 if (here.getAttribute("random")=="true") index=Math.floor(Math.random()*items.length);
 var txt=items[index];
 // re-render quote display element, and advance index counter
 removeChildren(here); wikify(txt,here);
 index++; here.setAttribute("nextItem",index);
 var cookie=here.getAttribute("cookie");
 if (cookie.length) {
 config.options["txtQOTD_"+cookie]=index.toString();
 saveOptionCookie("txtQOTD_"+cookie);
 }
 // redisplay slider panel (if any)
 if (p.className=="sliderPanel") {
 if(anim && config.options.chkAnimate)
 anim.startAnimating(new Slider(p,true,false,"none"));
 else p.style.display="block";
 }
 },
 getImageFileList: function(cwd) { // returns HR-separated list of image files
 function isImage(fn) {
 var ext=fn.substr(fn.length-3,3).toLowerCase();
 return ext=="jpg"||ext=="gif"||ext=="png";
 }
 var files=[];
 if (config.browser.isIE) {
 cwd=cwd.replace(/\//g,"\\");
 // IE uses ActiveX to read filesystem info
 var fso = new ActiveXObject("Scripting.FileSystemObject");
 if(!fso.FolderExists(cwd)) return [];
 var dir=fso.GetFolder(cwd);
 for(var f=new Enumerator(dir.Files); !f.atEnd(); f.moveNext())
 if (isImage(f.item().path)) files.push("[img[%0]]".format(["file:///"+f.item().path.replace(/\\/g,"/")]));
 } else {
 // FireFox (mozilla) uses "components" to read filesystem info
 // get security access
 if(!window.Components) return;
 try { netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect"); }
 catch(e) { alert(e.description?e.description:e.toString()); return []; }
 // open/validate directory
 var file=Components.classes["@mozilla.org/file/local;1"].createInstance(Components.interfaces.nsILocalFile);
 try { file.initWithPath(cwd); } catch(e) { return []; }
 if (!file.exists() || !file.isDirectory()) { return []; }
 var folder=file.directoryEntries;
 while (folder.hasMoreElements()) {
 var f=folder.getNext().QueryInterface(Components.interfaces.nsILocalFile);
 if (f instanceof Components.interfaces.nsILocalFile)
 if (isImage(f.path)) files.push("[img[%0]]".format(["file:///"+f.path.replace(/\\/g,"/")]));
 }
 }
 return files.join("\n----\n");
 }
}
//}}}
/% |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
!end
!show
<<tiddler {{
 var here=story.findContainingTiddler(place); if (here) {
  var nodes=here.getElementsByTagName("*");
  for (var i=0; i<nodes.length; i++) if (hasClass(nodes[i],"title"))
   { removeChildren(nodes[i]); wikify("$1",nodes[i]); break; }
 }
'';}}>>
!end
%/<<tiddler {{'.ReplaceTiddlerTitle##'+('$1'=='$'+'1'?'info':'show')}} with: [[$1]]>>
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
*/
//{{{
version.extensions.SinglePageModePlugin= {major: 2, minor: 9, revision: 7, date: new Date(2010,11,30)};
//}}}
//{{{
config.paramifiers.SPM = { onstart: function(v) {
 config.options.chkSinglePageMode=eval(v);
 if (config.options.chkSinglePageMode && config.options.chkSinglePagePermalink && !config.browser.isSafari) {
 config.lastURL = window.location.hash;
 if (!config.SPMTimer) config.SPMTimer=window.setInterval(function() {checkLastURL();},1000);
 }
} };
//}}}
//{{{
if (config.options.chkSinglePageMode==undefined)
 config.options.chkSinglePageMode=false;
if (config.options.chkSinglePagePermalink==undefined)
 config.options.chkSinglePagePermalink=true;
if (config.options.chkSinglePageKeepFoldedTiddlers==undefined)
 config.options.chkSinglePageKeepFoldedTiddlers=false;
if (config.options.chkSinglePageKeepEditedTiddlers==undefined)
 config.options.chkSinglePageKeepEditedTiddlers=false;
if (config.options.chkTopOfPageMode==undefined)
 config.options.chkTopOfPageMode=false;
if (config.options.chkBottomOfPageMode==undefined)
 config.options.chkBottomOfPageMode=false;
if (config.options.chkSinglePageAutoScroll==undefined)
 config.options.chkSinglePageAutoScroll=false;
//}}}
//{{{
config.SPMTimer = 0;
config.lastURL = window.location.hash;
function checkLastURL()
{
 if (!config.options.chkSinglePageMode)
 { window.clearInterval(config.SPMTimer); config.SPMTimer=0; return; }
 if (config.lastURL == window.location.hash) return; // no change in hash
 var tids=decodeURIComponent(window.location.hash.substr(1)).readBracketedList();
 if (tids.length==1) // permalink (single tiddler in URL)
 story.displayTiddler(null,tids[0]);
 else { // restore permaview or default view
 config.lastURL = window.location.hash;
 if (!tids.length) tids=store.getTiddlerText("DefaultTiddlers").readBracketedList();
 story.closeAllTiddlers();
 story.displayTiddlers(null,tids);
 }
}
if (Story.prototype.SPM_coreDisplayTiddler==undefined)
 Story.prototype.SPM_coreDisplayTiddler=Story.prototype.displayTiddler;
Story.prototype.displayTiddler = function(srcElement,tiddler,template,animate,slowly)
{
 var title=(tiddler instanceof Tiddler)?tiddler.title:tiddler;
 var tiddlerElem=story.getTiddler(title); // ==null unless tiddler is already displayed
 var opt=config.options;
 var single=opt.chkSinglePageMode && !startingUp;
 var top=opt.chkTopOfPageMode && !startingUp;
 var bottom=opt.chkBottomOfPageMode && !startingUp;
 if (single) {
 story.forEachTiddler(function(tid,elem) {
 // skip current tiddler and, optionally, tiddlers that are folded.
 if ( tid==title
 || (opt.chkSinglePageKeepFoldedTiddlers && elem.getAttribute("folded")=="true"))
 return;
 // if a tiddler is being edited, ask before closing
 if (elem.getAttribute("dirty")=="true") {
 if (opt.chkSinglePageKeepEditedTiddlers) return;
 // if tiddler to be displayed is already shown, then leave active tiddler editor as is
 // (occurs when switching between view and edit modes)
 if (tiddlerElem) return;
 // otherwise, ask for permission
 var msg="'"+tid+"' is currently being edited.\n\n";
 msg+="Press OK to save and close this tiddler\nor press Cancel to leave it opened";
 if (!confirm(msg)) return; else story.saveTiddler(tid);
 }
 story.closeTiddler(tid);
 });
 }
 else if (top)
 arguments[0]=null;
 else if (bottom)
 arguments[0]="bottom";
 if (single && opt.chkSinglePagePermalink && !config.browser.isSafari) {
 window.location.hash = encodeURIComponent(String.encodeTiddlyLink(title));
 config.lastURL = window.location.hash;
 document.title = wikifyPlain("SiteTitle") + " - " + title;
 if (!config.SPMTimer) config.SPMTimer=window.setInterval(function() {checkLastURL();},1000);
 }
 if (tiddlerElem && tiddlerElem.getAttribute("dirty")=="true") { // editing... move tiddler without re-rendering
 var isTopTiddler=(tiddlerElem.previousSibling==null);
 if (!isTopTiddler && (single || top))
 tiddlerElem.parentNode.insertBefore(tiddlerElem,tiddlerElem.parentNode.firstChild);
 else if (bottom)
 tiddlerElem.parentNode.insertBefore(tiddlerElem,null);
 else this.SPM_coreDisplayTiddler.apply(this,arguments); // let CORE render tiddler
 } else
 this.SPM_coreDisplayTiddler.apply(this,arguments); // let CORE render tiddler
 var tiddlerElem=story.getTiddler(title);
 if (tiddlerElem&&opt.chkSinglePageAutoScroll) {
 // scroll to top of page or top of tiddler
 var isTopTiddler=(tiddlerElem.previousSibling==null);
 var yPos=isTopTiddler?0:ensureVisible(tiddlerElem);
 // if animating, defer scroll until after animation completes
 var delay=opt.chkAnimate?config.animDuration+10:0;
 setTimeout("window.scrollTo(0,"+yPos+")",delay);
 }
}
if (Story.prototype.SPM_coreDisplayTiddlers==undefined)
 Story.prototype.SPM_coreDisplayTiddlers=Story.prototype.displayTiddlers;
Story.prototype.displayTiddlers = function() {
 // suspend single/top/bottom modes when showing multiple tiddlers
 var opt=config.options;
 var saveSPM=opt.chkSinglePageMode; opt.chkSinglePageMode=false;
 var saveTPM=opt.chkTopOfPageMode; opt.chkTopOfPageMode=false;
 var saveBPM=opt.chkBottomOfPageMode; opt.chkBottomOfPageMode=false;
 this.SPM_coreDisplayTiddlers.apply(this,arguments);
 opt.chkBottomOfPageMode=saveBPM;
 opt.chkTopOfPageMode=saveTPM;
 opt.chkSinglePageMode=saveSPM;
}
//}}}
/* |Author|SaqImtiaz|Version|2.02.2008.01.25|License|[[Creative Commons Attribution-ShareAlike 3.0 License|http://creativecommons.org/licenses/by-sa/3.0/]]| */
{{{
//!BEGIN-PLUGIN-CODE
config.tableSorting = {
 darrow: "\u2193",
 uarrow: "\u2191",
 getText : function (o) {
  var p = o.cells[SORT_INDEX];
  return p.innerText || p.textContent || '';
 },
 sortTable : function (o,rev) {
  SORT_INDEX = o.getAttribute("index");
  var c = config.tableSorting;
  var T = findRelated(o.parentNode,"TABLE");
  if(T.tBodies[0].rows.length<=1)
   return;
  var itm = "";
  var i = 0;
  while (itm == "" && i < T.tBodies[0].rows.length) {
   itm = c.getText(T.tBodies[0].rows[i]).trim();
   i++;
  }
  if (itm == "")
   return;
  var r = [];
  var S = o.getElementsByTagName("span")[0];
  c.fn = c.sortAlpha;
  if(!isNaN(Date.parse(itm)))
   c.fn = c.sortDate;
  else if(itm.match(/^[$|£|€|\+|\-]{0,1}\d*\.{0,1}\d+$/))
   c.fn = c.sortNumber;
  else if(itm.match(/^\d*\.{0,1}\d+[K|M|G]{0,1}b$/))
   c.fn = c.sortFile;
  for(i=0; i<T.tBodies[0].rows.length; i++) {
    r[i]=T.tBodies[0].rows[i];
  }
  r.sort(c.reSort);
  if(S.firstChild.nodeValue==c.darrow || rev) {
   r.reverse();
   S.firstChild.nodeValue=c.uarrow;
  }
  else
   S.firstChild.nodeValue=c.darrow;
  var thead = T.getElementsByTagName('thead')[0];
  var headers = thead.rows[thead.rows.length-1].cells;
  for(var k=0; k<headers.length; k++) {
   if(!hasClass(headers[k],"nosort"))
    addClass(headers[k].getElementsByTagName("span")[0],"hidden");
  }
  removeClass(S,"hidden");
  for(i=0; i<r.length; i++) {
   T.tBodies[0].appendChild(r[i]);
   c.stripe(r[i],i);
   for(var j=0; j<r[i].cells.length;j++){
    removeClass(r[i].cells[j],"sortedCol");
   }
   addClass(r[i].cells[SORT_INDEX],"sortedCol");
  }
 },
 stripe : function (e,i){
  var cl = ["oddRow","evenRow"];
  i&1? cl.reverse() : cl;
  removeClass(e,cl[1]);
  addClass(e,cl[0]);
 },
 sortNumber : function(v) {
  var x = parseFloat(this.getText(v).replace(/[^0-9.-]/g,''));
  return isNaN(x)? 0: x;
 },
 sortDate : function(v) {
  return Date.parse(this.getText(v));
 },
 sortAlpha : function(v) {
  return this.getText(v).toLowerCase();
 },
 sortFile : function(v) {
  var j, q = config.messages.sizeTemplates, s = this.getText(v);
  for (var i=0; i<q.length; i++) {
   if ((j = s.toLowerCase().indexOf(q[i].template.replace("%0\u00a0","").toLowerCase())) != -1)
    return q[i].unit * s.substr(0,j);
  }
  return parseFloat(s);
 },
 reSort : function(a,b){
  var c = config.tableSorting;
  var aa = c.fn(a);
  var bb = c.fn(b);
  return ((aa==bb)? 0 : ((aa<bb)? -1:1));
 }
};
Story.prototype.tSort_refreshTiddler = Story.prototype.refreshTiddler;
Story.prototype.refreshTiddler = function(title,template,force,customFields,defaultText){
 var elem = this.tSort_refreshTiddler.apply(this,arguments);
 if(elem){
  var tables = elem.getElementsByTagName("TABLE");
  var c = config.tableSorting;
  for(var i=0; i<tables.length; i++){
   if(hasClass(tables[i],"sortable")){
    var x = null, rev, table = tables[i], thead = table.getElementsByTagName('thead')[0], headers = thead.rows[thead.rows.length-1].cells;
    for (var j=0; j<headers.length; j++){
     var h = headers[j];
     if (hasClass(h,"nosort"))
      continue;
     h.setAttribute("index",j);
     h.onclick = function(){c.sortTable(this); return false;};
     h.ondblclick = stopEvent;
     if(h.getElementsByTagName("span").length == 0)
      createTiddlyElement(h,"span",null,"hidden",c.uarrow);
     if(!x && hasClass(h,"autosort")) {
      x = j;
      rev = hasClass(h,"reverse");
     }
    }
    if(x)
     c.sortTable(headers[x],rev);
   }
  }
 }
 return elem;
};
setStylesheet("table.sortable span.hidden {visibility:hidden;}\n"+
 "table.sortable thead {cursor:pointer;}\n"+
 "table.sortable .nosort {cursor:default;}\n"+
 "table.sortable td.sortedCol {background:#ffc;}","TableSortingPluginStyles");
function stopEvent(e){
 var ev = e? e : window.event;
 ev.cancelBubble = true;
 if (ev.stopPropagation) ev.stopPropagation();
 return false;
}
config.macros.nosort={
 handler : function(place){
  addClass(place,"nosort");
 }
};
config.macros.autosort={
 handler : function(place,m,p,w,pS){
  addClass(place,"autosort"+" "+pS);
 }
};
}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements| */
//{{{
version.extensions.WikifyPlugin= {major: 1, minor: 1, revision: 4, date: new Date(2009,3,29)};
config.macros.wikify={
 handler: function(place,macroName,params,wikifier,paramString,tiddler) {
  var fmt=params.shift();
  var values=[];
  var out="";
  if (!fmt.match(/\%[0-9]/g) && params.length) // format has no markers, just join all params with spaces
   out=fmt+" "+params.join(" ");
  else { // format param has markers, get values and perform substitution
   while (p=params.shift()) values.push(this.getFieldReference(place,p));
   out=fmt.format(values);
  }
  if (macroName=="wikiCalc") out=eval(out).toString();
  wikify(out.unescapeLineBreaks(),place,null,tiddler);
 },
 getFieldReference: function(place,p) { // "slicename::tiddlername" or "fieldname@tiddlername" or "fieldname"
  if (typeof p != "string") return p; // literal non-string value... just return it...
  var parts=p.split(config.textPrimitives.sliceSeparator);
  if (parts.length==2) {// maybe a slice reference?
   var tid=parts[0]; var slice=parts[1];
   if (!tid || !tid.length || tid=="here") { // no target (or "here"), use containing tiddler
    tid=story.findContainingTiddler(place);
    if (tid) tid=tid.getAttribute("tiddler")
    else tid="SiteSlices"; // fallback for 'non-tiddler' areas (e.g, header, sidebar, etc.)
   }
   var val=store.getTiddlerSlice(tid,slice); // get tiddler slice value
  }
  if (val==undefined) {// not a slice, or slice not found, maybe a field reference?
   var parts=p.split("@");
   var field=parts[0];
   if (!field || !field.length) field="checked"; // missing fieldname, fallback: checked@tiddlername
   var tid=parts[1];
   if (!tid || !tid.length || tid=="here") { // no target (or "here"), use containing tiddler
    tid=story.findContainingTiddler(place);
    if (tid) tid=tid.getAttribute("tiddler")
    else tid="SiteFields"; // fallback for 'non-tiddler' areas (e.g, header, sidebar, etc.)
   }
   var val=store.getValue(tid,field);
  }
  // not a slice or field, or slice/field not found... return value unchanged
  return val===undefined?p:val;
 }
}
//}}}
//{{{
// define alternative macroName for triggering pre-rendering call to eval()
config.macros.wikiCalc=config.macros.wikify;
//}}}
<!--{{{-->
<span class='yourSearchNumber' macro='foundTiddler number'></span>
<span class='yourSearchTitle' macro='foundTiddler title text 100'/></span> —
<span class='yourSearchTags' macro='foundTiddler field tags 0'/></span>
<!--}}}-->
/* |YourSearchPlugin v2.1.6 (2012-04-19)|http://tiddlywiki.abego-software.de/#YourSearchPlugin|https://github.com/abego/YourSearchPlugin|
|Author|UdoBorkowski (ub [at] abego-software [dot] de)|[[BSD open source license|http://www.abego-software.de/legal/apl-v10.html]]| */
///%
if(!version.extensions.YourSearchPlugin){version.extensions.YourSearchPlugin={major:2,minor:1,revision:6,source:"http://tiddlywiki.abego-software.de/#YourSearchPlugin",licence:"[[BSD open source license (abego Software)|http://www.abego-software.de/legal/apl-v10.html]]",copyright:"Copyright (c) abego Software GmbH, 2005-2012 (www.abego-software.de)"};if(!window.abego){window.abego={}}if(!Array.forEach){Array.forEach=function(c,e,d){for(var b=0,a=c.length;b<a;b++){e.call(d,c[b],b,c)}};Array.prototype.forEach=function(d,c){for(var b=0,a=this.length;b<a;b++){d.call(c,this[b],b,this)}}}abego.toInt=function(b,a){if(!b){return a}var c=parseInt(b);return(c==NaN)?a:c};abego.createEllipsis=function(a){var b=createTiddlyElement(a,"span");b.innerHTML="&hellip;"};abego.shallowCopy=function(b){if(!b){return b}var a={};for(var c in b){a[c]=b[c]}return a};abego.copyOptions=function(a){return !a?{}:abego.shallowCopy(a)};abego.countStrings=function(d,c){if(!c){return 0}var a=c.length;var f=0;var e=0;while(true){var b=d.indexOf(c,e);if(b<0){return f}f++;e=b+a}return f};abego.getBracedText=function(j,e,a){if(!e){e=0}var k=/\{([^\}]*)\}/gm;k.lastIndex=e;var d=k.exec(j);if(d){var l=d[1];var b=abego.countStrings(l,"{");if(!b){if(a){a.lastIndex=k.lastIndex}return l}var g=j.length;for(var f=k.lastIndex;f<g&&b;f++){var h=j.charAt(f);if(h=="{"){b++}else{if(h=="}"){b--}}}if(!b){if(a){a.lastIndex=f-1}return j.substring(d.index+1,f-1)}}};abego.select=function(d,c,b,a){if(!a){a=[]}d.forEach(function(e){if(c.call(b,e)){a.push(e)}});return a};abego.consumeEvent=function(a){if(a.stopPropagation){a.stopPropagation()}if(a.preventDefault){a.preventDefault()}a.cancelBubble=true;a.returnValue=true};abego.TiddlerFilterTerm=function(d,b){if(!b){b={}}var c=d;if(!b.textIsRegExp){c=d.escapeRegExp();if(b.fullWordMatch){c="\\b"+c+"\\b"}}var a=new RegExp(c,"m"+(b.caseSensitive?"":"i"));this.tester=new abego.MultiFieldRegExpTester(a,b.fields,b.withExtendedFields)};abego.TiddlerFilterTerm.prototype.test=function(a){return this.tester.test(a)};abego.parseNewTiddlerCommandLine=function(c){var a=/(.*?)\.(?:\s+|$)([^#]*)(#.*)?/.exec(c);if(!a){a=/([^#]*)()(#.*)?/.exec(c)}if(a){var d;if(a[3]){var b=a[3].replace(/#/g,"");d=b.parseParams("tag")}else{d=[[]]}var e=a[2]?a[2].trim():"";d.push({name:"text",value:e});d[0].text=[e];return{title:a[1].trim(),params:d}}else{return{title:c.trim(),params:[[]]}}};abego.parseTiddlerFilterTerm=function(queryText,offset,options){var re=/\s*(?:(?:\{([^\}]*)\})|(?:(=)|([#%!])|(?:(\w+)\s*\:(?!\/\/))|(?:(?:("(?:(?:\\")|[^"])+")|(?:\/((?:(?:\\\/)|[^\/])+)\/)|(\w+\:\/\/[^\s]+)|([^\s\)\-\"]+)))))/mg;var shortCuts={"!":"title","%":"text","#":"tags"};var fieldNames={};var fullWordMatch=false;re.lastIndex=offset;while(true){var i=re.lastIndex;var m=re.exec(queryText);if(!m||m.index!=i){throw"Word or String literal expected"}if(m[1]){var lastIndexRef={};var code=abego.getBracedText(queryText,0,lastIndexRef);if(!code){throw"Invalid {...} syntax"}var f=Function("tiddler","return ("+code+");");return{func:f,lastIndex:lastIndexRef.lastIndex,markRE:null}}if(m[2]){fullWordMatch=true}else{if(m[3]){fieldNames[shortCuts[m[3]]]=1}else{if(m[4]){fieldNames[m[4]]=1}else{var textIsRegExp=m[6];var text=m[5]?window.eval(m[5]):m[6]?m[6]:m[7]?m[7]:m[8];options=abego.copyOptions(options);options.fullWordMatch=fullWordMatch;options.textIsRegExp=textIsRegExp;var fields=[];for(var n in fieldNames){fields.push(n)}if(fields.length==0){options.fields=options.defaultFields}else{options.fields=fields;options.withExtendedFields=false}var term=new abego.TiddlerFilterTerm(text,options);var markREText=textIsRegExp?text:text.escapeRegExp();if(markREText&&fullWordMatch){markREText="\\b"+markREText+"\\b"}return{func:function(tiddler){return term.test(tiddler)},lastIndex:re.lastIndex,markRE:markREText?"(?:"+markREText+")":null}}}}}};abego.BoolExp=function(i,c,j){this.s=i;var h=j&&j.defaultOperationIs_OR;var e=/\s*\)/g;var f=/\s*(?:(and|\&\&)|(or|\|\|))/gi;var b=/\s*(\-|not)?(\s*\()?/gi;var a;var d=function(p){b.lastIndex=p;var l=b.exec(i);var o=false;var k=null;if(l&&l.index==p){p+=l[0].length;o=l[1];if(l[2]){var n=a(p);e.lastIndex=n.lastIndex;if(!e.exec(i)){throw"Missing ')'"}k={func:n.func,lastIndex:e.lastIndex,markRE:n.markRE}}}if(!k){k=c(i,p,j)}if(o){k.func=(function(m){return function(q){return !m(q)}})(k.func);k.markRE=null}return k};a=function(s){var n=d(s);while(true){var p=n.lastIndex;f.lastIndex=p;var k=f.exec(i);var o;var q;if(k&&k.index==p){o=!k[1];q=d(f.lastIndex)}else{try{q=d(p)}catch(r){return n}o=h}n.func=(function(t,m,l){return l?function(u){return t(u)||m(u)}:function(u){return t(u)&&m(u)}})(n.func,q.func,o);n.lastIndex=q.lastIndex;if(!n.markRE){n.markRE=q.markRE}else{if(q.markRE){n.markRE=n.markRE+"|"+q.markRE}}}};var g=a(0);this.evalFunc=g.func;if(g.markRE){this.markRegExp=new RegExp(g.markRE,j.caseSensitive?"mg":"img")}};abego.BoolExp.prototype.exec=function(){return this.evalFunc.apply(this,arguments)};abego.BoolExp.prototype.getMarkRegExp=function(){return this.markRegExp};abego.BoolExp.prototype.toString=function(){return this.s};abego.MultiFieldRegExpTester=function(b,a,c){this.re=b;this.fields=a?a:["title","text","tags"];this.withExtendedFields=c};abego.MultiFieldRegExpTester.prototype.test=function(b){var d=this.re;for(var a=0;a<this.fields.length;a++){var c=store.getValue(b,this.fields[a]);if(typeof c=="string"&&d.test(c)){return this.fields[a]}}if(this.withExtendedFields){return store.forEachField(b,function(e,g,f){return typeof f=="string"&&d.test(f)?g:null},true)}return null};abego.TiddlerQuery=function(b,a,d,c,e){if(d){this.regExp=new RegExp(b,a?"mg":"img");this.tester=new abego.MultiFieldRegExpTester(this.regExp,c,e)}else{this.expr=new abego.BoolExp(b,abego.parseTiddlerFilterTerm,{defaultFields:c,caseSensitive:a,withExtendedFields:e})}this.getQueryText=function(){return b};this.getUseRegExp=function(){return d};this.getCaseSensitive=function(){return a};this.getDefaultFields=function(){return c};this.getWithExtendedFields=function(){return e}};abego.TiddlerQuery.prototype.test=function(a){if(!a){return false}if(this.regExp){return this.tester.test(a)}return this.expr.exec(a)};abego.TiddlerQuery.prototype.filter=function(a){return abego.select(a,this.test,this)};abego.TiddlerQuery.prototype.getMarkRegExp=function(){if(this.regExp){return"".search(this.regExp)>=0?null:this.regExp}return this.expr.getMarkRegExp()};abego.TiddlerQuery.prototype.toString=function(){return(this.regExp?this.regExp:this.expr).toString()};abego.PageWiseRenderer=function(){this.firstIndexOnPage=0};merge(abego.PageWiseRenderer.prototype,{setItems:function(a){this.items=a;this.setFirstIndexOnPage(0)},getMaxPagesInNavigation:function(){return 10},getItemsCount:function(a){return this.items?this.items.length:0},getCurrentPageIndex:function(){return Math.floor(this.firstIndexOnPage/this.getItemsPerPage())},getLastPageIndex:function(){return Math.floor((this.getItemsCount()-1)/this.getItemsPerPage())},setFirstIndexOnPage:function(a){this.firstIndexOnPage=Math.min(Math.max(0,a),this.getItemsCount()-1)},getFirstIndexOnPage:function(){this.firstIndexOnPage=Math.floor(this.firstIndexOnPage/this.getItemsPerPage())*this.getItemsPerPage();return this.firstIndexOnPage},getLastIndexOnPage:function(){return Math.min(this.getFirstIndexOnPage()+this.getItemsPerPage()-1,this.getItemsCount()-1)},onPageChanged:function(a,b){},renderPage:function(a){if(a.beginRendering){a.beginRendering(this)}try{if(this.getItemsCount()){var d=this.getLastIndexOnPage();var c=-1;for(var b=this.getFirstIndexOnPage();b<=d;b++){c++;a.render(this,this.items[b],b,c)}}}finally{if(a.endRendering){a.endRendering(this)}}},addPageNavigation:function(c){if(!this.getItemsCount()){return}var k=this;var g=function(n){if(!n){n=window.event}abego.consumeEvent(n);var i=abego.toInt(this.getAttribute("page"),0);var m=k.getCurrentPageIndex();if(i==m){return}var l=i*k.getItemsPerPage();k.setFirstIndexOnPage(l);k.onPageChanged(i,m)};var e;var h=this.getCurrentPageIndex();var f=this.getLastPageIndex();if(h>0){e=createTiddlyButton(c,"Précédent","Page précédente (Raccourci: Alt-'<')",g,"prev");e.setAttribute("page",(h-1).toString());e.setAttribute("accessKey","<")}for(var d=-this.getMaxPagesInNavigation();d<this.getMaxPagesInNavigation();d++){var b=h+d;if(b<0){continue}if(b>f){break}var a=(d+h+1).toString();var j=b==h?"currentPage":"otherPage";e=createTiddlyButton(c,a,"Aller page %0".format([a]),g,j);e.setAttribute("page",(b).toString())}if(h<f){e=createTiddlyButton(c,"Suivant","Page suivante (Raccourci: Alt-'>')",g,"next");e.setAttribute("page",(h+1).toString());e.setAttribute("accessKey",">")}}});abego.LimitedTextRenderer=function(){var l=40;var c=4;var k=function(p,z,v){var q=p.length;if(q==0){p.push({start:z,end:v});return}var u=0;for(;u<q;u++){var w=p[u];if(w.start<=v&&z<=w.end){var o;var s=u+1;for(;s<q;s++){o=p[s];if(o.start>v||z>w.end){break}}var x=z;var y=v;for(var t=u;t<s;t++){o=p[t];x=Math.min(x,o.start);y=Math.max(y,o.end)}p.splice(u,s-u,{start:x,end:y});return}if(w.start>v){break}}p.splice(u,0,{start:z,end:v})};var d=function(n){var q=0;for(var p=0;p<n.length;p++){var o=n[p];q+=o.end-o.start}return q};var b=function(n){return(n>="a"&&n<="z")||(n>="A"&&n<="Z")||n=="_"};var f=function(p,r){if(!b(p[r])){return null}for(var o=r-1;o>=0&&b(p[o]);o--){}var q=o+1;var t=p.length;for(o=r+1;o<t&&b(p[o]);o++){}return{start:q,end:o}};var a=function(o,q,p){var n;if(p){n=f(o,q)}else{if(q<=0){return q}n=f(o,q-1)}if(!n){return q}if(p){if(n.start>=q-c){return n.start}if(n.end<=q+c){return n.end}}else{if(n.end<=q+c){return n.end}if(n.start>=q-c){return n.start}}return q};var j=function(r,q){var n=[];if(q){var u=0;do{q.lastIndex=u;var o=q.exec(r);if(o){if(u<o.index){var p=r.substring(u,o.index);n.push({text:p})}n.push({text:o[0],isMatch:true});u=o.index+o[0].length}else{n.push({text:r.substr(u)});break}}while(true)}else{n.push({text:r})}return n};var i=function(p){var n=0;for(var o=0;o<p.length;o++){if(p[o].isMatch){n++}}return n};var h=function(v,u,q,t,o){var w=Math.max(Math.floor(o/(t+1)),l);var n=Math.max(w-(q-u),0);var r=Math.min(Math.floor(q+n/3),v.length);var p=Math.max(r-w,0);p=a(v,p,true);r=a(v,r,false);return{start:p,end:r}};var m=function(r,y,o){var n=[];var v=i(r);var u=0;for(var p=0;p<r.length;p++){var x=r[p];var w=x.text;if(x.isMatch){var q=h(y,u,u+w.length,v,o);k(n,q.start,q.end)}u+=w.length}return n};var g=function(t,p,o){var n=o-d(p);while(n>0){if(p.length==0){k(p,0,a(t,o,false));return}else{var q=p[0];var v;var r;if(q.start==0){v=q.end;if(p.length>1){r=p[1].start}else{k(p,v,a(t,v+n,false));return}}else{v=0;r=q.start}var u=Math.min(r,v+n);k(p,v,u);n-=(u-v)}}};var e=function(p,x,w,n,o){if(n.length==0){return}var u=function(z,I,D,F,C){var H;var G;var E=0;var B=0;var A=0;for(;B<D.length;B++){H=D[B];G=H.text;if(F<E+G.length){A=F-E;break}E+=G.length}var y=C-F;for(;B<D.length&&y>0;B++){H=D[B];G=H.text.substr(A);A=0;if(G.length>y){G=G.substr(0,y)}if(H.isMatch){createTiddlyElement(z,"span",null,"marked",G)}else{createTiddlyText(z,G)}y-=G.length}if(C<I.length){abego.createEllipsis(z)}};if(n[0].start>0){abego.createEllipsis(p)}var q=o;for(var r=0;r<n.length&&q>0;r++){var t=n[r];var v=Math.min(t.end-t.start,q);u(p,x,w,t.start,t.start+v);q-=v}};this.render=function(p,q,o,t){if(q.length<o){o=q.length}var r=j(q,t);var n=m(r,q,o);g(q,n,o);e(p,q,r,n,o)}};(function(){function alertAndThrow(msg){alert(msg);throw msg}if(version.major<2||(version.major==2&&version.minor<1)){alertAndThrow("YourSearchPlugin requires TiddlyWiki 2.1 or newer.\n\nCheck the archive for YourSearch plugins\nsupporting older versions of TiddlyWiki.\n\nArchive: http://tiddlywiki.abego-software.de/archive")}abego.YourSearch={};var lastResults=undefined;var lastQuery=undefined;var setLastResults=function(array){lastResults=array};var getLastResults=function(){return lastResults?lastResults:[]};var getLastResultsCount=function(){return lastResults?lastResults.length:0};var matchInTitleWeight=4;var precisionInTitleWeight=10;var matchInTagsWeight=2;var getMatchCount=function(s,re){var m=s.match(re);return m?m.length:0};var standardRankFunction=function(tiddler,query){var markRE=query.getMarkRegExp();if(!markRE){return 1}var matchesInTitle=tiddler.title.match(markRE);var nMatchesInTitle=matchesInTitle?matchesInTitle.length:0;var nMatchesInTags=getMatchCount(tiddler.getTags(),markRE);var lengthOfMatchesInTitle=matchesInTitle?matchesInTitle.join("").length:0;var precisionInTitle=tiddler.title.length>0?lengthOfMatchesInTitle/tiddler.title.length:0;var rank=nMatchesInTitle*matchInTitleWeight+nMatchesInTags*matchInTagsWeight+precisionInTitle*precisionInTitleWeight+1;return rank};var findMatches=function(store,searchText,caseSensitive,useRegExp,sortField,excludeTag){lastQuery=null;var candidates=store.reverseLookup("tags",excludeTag,false);try{var defaultFields=[];if(config.options.chkSearchInTitle){defaultFields.push("title")}if(config.options.chkSearchInText){defaultFields.push("text")}if(config.options.chkSearchInTags){defaultFields.push("tags")}lastQuery=new abego.TiddlerQuery(searchText,caseSensitive,useRegExp,defaultFields,config.options.chkSearchExtendedFields)}catch(e){return[]}var results=lastQuery.filter(candidates);var rankFunction=abego.YourSearch.getRankFunction();for(var i=0;i<results.length;i++){var tiddler=results[i];var rank=rankFunction(tiddler,lastQuery);tiddler.searchRank=rank}if(!sortField){sortField="title"}var sortFunction=function(a,b){var searchRankDiff=a.searchRank-b.searchRank;if(searchRankDiff==0){if(a[sortField]==b[sortField]){return(0)}else{return(a[sortField]<b[sortField])?-1:+1}}else{return(searchRankDiff>0)?-1:+1}};results.sort(sortFunction);return results};var maxCharsInTitle=80;var maxCharsInTags=50;var maxCharsInText=250;var maxCharsInField=50;var itemsPerPageDefault=25;var itemsPerPageWithPreviewDefault=10;var yourSearchResultID="yourSearchResult";var yourSearchResultItemsID="yourSearchResultItems";var lastSearchText=null;var resultElement=null;var searchInputField=null;var searchButton=null;var lastNewTiddlerButton=null;var initStylesheet=function(){if(version.extensions.YourSearchPlugin.styleSheetInited){return}version.extensions.YourSearchPlugin.styleSheetInited=true;setStylesheet(store.getTiddlerText("YourSearchStyleSheet"),"yourSearch")};var isResultOpen=function(){return resultElement!=null&&resultElement.parentNode==document.body};var closeResult=function(){if(isResultOpen()){document.body.removeChild(resultElement)}};var closeResultAndDisplayTiddler=function(e){closeResult();var title=this.getAttribute("tiddlyLink");if(title){var withHilite=this.getAttribute("withHilite");var oldHighlightHack=highlightHack;if(withHilite&&withHilite=="true"&&lastQuery){highlightHack=lastQuery.getMarkRegExp()}story.displayTiddler(this,title);highlightHack=oldHighlightHack}return(false)};var adjustResultPositionAndSize=function(){if(!searchInputField){return}var root=searchInputField;var rootLeft=findPosX(root);var rootTop=findPosY(root);var rootHeight=root.offsetHeight;var popupLeft=rootLeft;var popupTop=rootTop+rootHeight;var winWidth=findWindowWidth();if(winWidth<resultElement.offsetWidth){resultElement.style.width=(winWidth-100)+"px";winWidth=findWindowWidth()}var popupWidth=resultElement.offsetWidth;if(popupLeft+popupWidth>winWidth){popupLeft=winWidth-popupWidth-30}if(popupLeft<0){popupLeft=0}resultElement.style.left=popupLeft+"px";resultElement.style.top=popupTop+"px";resultElement.style.display="block"};var scrollVisible=function(){if(resultElement){window.scrollTo(0,ensureVisible(resultElement))}if(searchInputField){window.scrollTo(0,ensureVisible(searchInputField))}};var ensureResultIsDisplayedNicely=function(){adjustResultPositionAndSize();scrollVisible()};var indexInPage=undefined;var currentTiddler=undefined;var pager=new abego.PageWiseRenderer();var MyItemRenderer=function(parent){this.itemHtml=store.getTiddlerText(".YourSearchItemTemplate");if(!this.itemHtml){alertAndThrow(".YourSearchItemTemplate not found")}this.place=document.getElementById(yourSearchResultItemsID);if(!this.place){this.place=createTiddlyElement(parent,"div",yourSearchResultItemsID)}};merge(MyItemRenderer.prototype,{render:function(pager,object,index,indexOnPage){indexInPage=indexOnPage;currentTiddler=object;var item=createTiddlyElement(this.place,"div",null,"yourSearchItem");item.innerHTML=this.itemHtml;applyHtmlMacros(item,null);refreshElements(item,null)},endRendering:function(pager){currentTiddler=null}});var refreshResult=function(){if(!resultElement||!searchInputField){return}var html=store.getTiddlerText("YourSearchResultTemplate");if(!html){html="<b>Tiddler YourSearchResultTemplate not found</b>"}resultElement.innerHTML=html;applyHtmlMacros(resultElement,null);refreshElements(resultElement,null);var itemRenderer=new MyItemRenderer(resultElement);pager.renderPage(itemRenderer);ensureResultIsDisplayedNicely()};pager.getItemsPerPage=function(){var n=(config.options.chkPreviewText)?abego.toInt(config.options.txtItemsPerPageWithPreview,itemsPerPageWithPreviewDefault):abego.toInt(config.options.txtItemsPerPage,itemsPerPageDefault);return(n>0)?n:1};pager.onPageChanged=function(){refreshResult()};var reopenResultIfApplicable=function(){if(searchInputField==null||!config.options.chkUseYourSearch){return}if((searchInputField.value==lastSearchText)&&lastSearchText&&!isResultOpen()){if(resultElement&&(resultElement.parentNode!=document.body)){document.body.appendChild(resultElement);ensureResultIsDisplayedNicely()}else{abego.YourSearch.onShowResult(true)}}};var invalidateResult=function(){closeResult();resultElement=null;lastSearchText=null};var isDescendantOrSelf=function(self,e){while(e!=null){if(self==e){return true}e=e.parentNode}return false};var onDocumentClick=function(e){if(e.target==searchInputField){return}if(e.target==searchButton){return}if(resultElement&&isDescendantOrSelf(resultElement,e.target)){return}closeResult()};var onDocumentKeyup=function(e){if(e.keyCode==27){closeResult()}};addEvent(document,"click",onDocumentClick);addEvent(document,"keyup",onDocumentKeyup);var myStorySearch=function(text,useCaseSensitive,useRegExp){lastSearchText=text;setLastResults(findMatches(store,text,useCaseSensitive,useRegExp,"title","excludeSearch"));abego.YourSearch.onShowResult()};var myMacroSearchHandler=function(place,macroName,params,wikifier,paramString,tiddler){initStylesheet();lastSearchText="";var searchTimeout=null;var doSearch=function(txt){if(config.options.chkUseYourSearch){myStorySearch(txt.value,config.options.chkCaseSensitiveSearch,config.options.chkRegExpSearch)}else{story.search(txt.value,config.options.chkCaseSensitiveSearch,config.options.chkRegExpSearch)}lastSearchText=txt.value};var clickHandler=function(e){doSearch(searchInputField);return false};var keyHandler=function(e){if(!e){e=window.event}searchInputField=this;switch(e.keyCode){case 13:if(e.ctrlKey&&lastNewTiddlerButton&&isResultOpen()){lastNewTiddlerButton.onclick.apply(lastNewTiddlerButton,[e])}else{doSearch(this)}break;case 27:if(isResultOpen()){closeResult()}else{this.value="";clearMessage()}break}if(String.fromCharCode(e.keyCode)==this.accessKey||e.altKey){reopenResultIfApplicable()}if(this.value.length<3&&searchTimeout){clearTimeout(searchTimeout)}if(this.value.length>2){if(this.value!=lastSearchText){if(!config.options.chkUseYourSearch||config.options.chkSearchAsYouType){if(searchTimeout){clearTimeout(searchTimeout)}var txt=this;searchTimeout=setTimeout(function(){doSearch(txt)},500)}}else{if(searchTimeout){clearTimeout(searchTimeout)}}}if(this.value.length==0){closeResult()}};var focusHandler=function(e){this.select();clearMessage();reopenResultIfApplicable()};var args=paramString.parseParams("list",null,true);var buttonAtRight=getFlag(args,"buttonAtRight");var sizeTextbox=getParam(args,"sizeTextbox",this.sizeTextbox);var txt=createTiddlyElement(null,"input",null,"txtOptionInput searchField",null);if(params[0]){txt.value=params[0]}txt.onkeyup=keyHandler;txt.onfocus=focusHandler;txt.setAttribute("size",sizeTextbox);txt.setAttribute("accessKey",this.accessKey);txt.setAttribute("autocomplete","off");if(config.browser.isSafari){txt.setAttribute("type","search");txt.setAttribute("results","5")}else{if(!config.browser.isIE){txt.setAttribute("type","text")}}var btn=createTiddlyButton(null,this.label,this.prompt,clickHandler);if(place){if(!buttonAtRight){place.appendChild(btn)}place.appendChild(txt);if(buttonAtRight){place.appendChild(btn)}}searchInputField=txt;searchButton=btn};var openAllFoundTiddlers=function(){closeResult();var results=getLastResults();var n=results.length;if(n){var titles=[];for(var i=0;i<n;i++){titles.push(results[i].title)}story.displayTiddlers(null,titles)}};var createOptionWithRefresh=function(place,optionParams,wikifier,tiddler){invokeMacro(place,"option",optionParams,wikifier,tiddler);var elem=place.lastChild;var oldOnClick=elem.onclick;elem.onclick=function(e){var result=oldOnClick.apply(this,arguments);refreshResult();return result};return elem};var removeTextDecoration=function(s){var removeThis=["''","{{{","}}}","//","<<<","/***","***/"];var reText="";for(var i=0;i<removeThis.length;i++){if(i!=0){reText+="|"}reText+="("+removeThis[i].escapeRegExp()+")"}return s.replace(new RegExp(reText,"mg"),"").trim()};var getShortCutNumber=function(){var i=indexInPage;return(i>=0&&i<=9)?(i<9?(i+1):0):-1};var limitedTextRenderer=new abego.LimitedTextRenderer();var renderLimitedText=function(place,s,maxLen){limitedTextRenderer.render(place,s,maxLen,lastQuery.getMarkRegExp())};var oldTiddlyWikiSaveTiddler=TiddlyWiki.prototype.saveTiddler;TiddlyWiki.prototype.saveTiddler=function(title,newTitle,newBody,modifier,modified,tags,fields){oldTiddlyWikiSaveTiddler.apply(this,arguments);invalidateResult()};var oldTiddlyWikiRemoveTiddler=TiddlyWiki.prototype.removeTiddler;TiddlyWiki.prototype.removeTiddler=function(title){oldTiddlyWikiRemoveTiddler.apply(this,arguments);invalidateResult()};config.macros.yourSearch={label:"yourSearch",prompt:"Gives access to the current/last YourSearch result",handler:function(place,macroName,params,wikifier,paramString,tiddler){if(params.length==0){return}var name=params[0];var func=config.macros.yourSearch.funcs[name];if(func){func(place,macroName,params,wikifier,paramString,tiddler)}},tests:{"true":function(){return true},"false":function(){return false},found:function(){return getLastResultsCount()>0},previewText:function(){return config.options.chkPreviewText}},funcs:{itemRange:function(place){if(getLastResultsCount()){var lastIndex=pager.getLastIndexOnPage();var s="%0 - %1".format([pager.getFirstIndexOnPage()+1,lastIndex+1]);createTiddlyText(place,s)}},count:function(place){createTiddlyText(place,getLastResultsCount().toString())},query:function(place){if(lastQuery){createTiddlyText(place,lastQuery.toString())}},version:function(place){var t="YourSearch %0.%1.%2".format([version.extensions.YourSearchPlugin.major,version.extensions.YourSearchPlugin.minor,version.extensions.YourSearchPlugin.revision]);var e=createTiddlyElement(place,"a");e.setAttribute("href","http://tiddlywiki.abego-software.de/#YourSearchPlugin");e.innerHTML='<font color="black" weight="bold" face="Arial, Helvetica, sans-serif">'+t+"<font>"},copyright:function(place){var e=createTiddlyElement(place,"a");e.setAttribute("href","http://www.abego-software.de");e.innerHTML='<font color="black" face="Arial, Helvetica, sans-serif">&copy; 2005-2019 <b><font color="blue">abego</font></b> Software<font>'},newTiddlerButton:function(place){if(lastQuery){var r=abego.parseNewTiddlerCommandLine(lastQuery.getQueryText());var btn=config.macros.newTiddler.createNewTiddlerButton(place,r.title,r.params,"","",null,"text");var oldOnClick=btn.onclick;btn.onclick=function(){closeResult();oldOnClick.apply(this,arguments)};lastNewTiddlerButton=btn}},linkButton:function(place,macroName,params,wikifier,paramString,tiddler){if(params<2){return}var tiddlyLink=params[1];var text=params<3?tiddlyLink:params[2];var tooltip=params<4?text:params[3];var accessKey=params<5?null:params[4];var btn=createTiddlyButton(place,text,tooltip,closeResultAndDisplayTiddler,null,null,accessKey);btn.setAttribute("tiddlyLink",tiddlyLink)},closeButton:function(place,macroName,params,wikifier,paramString,tiddler){createTiddlyButton(place,"Fermer","Fermer la zone de recherche (touche \'ESC\')",closeResult)},openAllButton:function(place,macroName,params,wikifier,paramString,tiddler){var n=getLastResultsCount();if(n==0){return}var title=n==1?"open tiddler":"Ouvrir les %0 articles".format([n]);var button=createTiddlyButton(place,title,"Ouvrir tous les articles (Raccourci : Alt-O)",openAllFoundTiddlers);button.setAttribute("accessKey","O")},naviBar:function(place,macroName,params,wikifier,paramString,tiddler){pager.addPageNavigation(place)},"if":function(place,macroName,params,wikifier,paramString,tiddler){if(params.length<2){return}var testName=params[1];var negate=(testName=="not");if(negate){if(params.length<3){return}testName=params[2]}var test=config.macros.yourSearch.tests[testName];var showIt=false;try{if(test){showIt=test(place,macroName,params,wikifier,paramString,tiddler)!=negate}else{showIt=(!eval(testName))==negate}}catch(ex){}if(!showIt){place.style.display="none"}},chkPreviewText:function(place,macroName,params,wikifier,paramString,tiddler){var elem=createOptionWithRefresh(place,"chkPreviewText",wikifier,tiddler);elem.setAttribute("accessKey","P");elem.title="Prévisualisation des articles (Raccourci : Alt-P)";return elem}}};config.macros.foundTiddler={label:"foundTiddler",prompt:"Provides information on the tiddler currently processed on the YourSearch result page",handler:function(place,macroName,params,wikifier,paramString,tiddler){var name=params[0];var func=config.macros.foundTiddler.funcs[name];if(func){func(place,macroName,params,wikifier,paramString,tiddler)}},funcs:{title:function(place,macroName,params,wikifier,paramString,tiddler){if(!currentTiddler){return}var shortcutNumber=getShortCutNumber();var tooltip=shortcutNumber>=0?"Ouvrir l\'article (Raccourci : Alt-%0)".format([shortcutNumber.toString()]):"Open tiddler";var btn=createTiddlyButton(place,null,tooltip,closeResultAndDisplayTiddler,null);btn.setAttribute("tiddlyLink",currentTiddler.title);btn.setAttribute("withHilite","true");renderLimitedText(btn,currentTiddler.title,maxCharsInTitle);if(shortcutNumber>=0){btn.setAttribute("accessKey",shortcutNumber.toString())}},tags:function(place,macroName,params,wikifier,paramString,tiddler){if(!currentTiddler){return}renderLimitedText(place,currentTiddler.getTags(),maxCharsInTags)},text:function(place,macroName,params,wikifier,paramString,tiddler){if(!currentTiddler){return}renderLimitedText(place,removeTextDecoration(currentTiddler.text),maxCharsInText)},field:function(place,macroName,params,wikifier,paramString,tiddler){if(!currentTiddler){return}var name=params[1];var len=params.length>2?abego.toInt(params[2],maxCharsInField):maxCharsInField;var v=store.getValue(currentTiddler,name);if(v){renderLimitedText(place,removeTextDecoration(v),len)}},number:function(place,macroName,params,wikifier,paramString,tiddler){var numberToDisplay=getShortCutNumber();if(numberToDisplay>=0){var text="%0)".format([numberToDisplay.toString()]);createTiddlyElement(place,"span",null,"shortcutNumber",text)}}}};var opts={chkUseYourSearch:true,chkPreviewText:true,chkSearchAsYouType:true,chkSearchInTitle:true,chkSearchInText:true,chkSearchInTags:true,chkSearchExtendedFields:true,txtItemsPerPage:itemsPerPageDefault,txtItemsPerPageWithPreview:itemsPerPageWithPreviewDefault};for(var n in opts){if(config.options[n]==undefined){config.options[n]=opts[n]}}config.shadowTiddlers.AdvancedOptions+="\n<<option chkUseYourSearch>> Use 'Your Search' ";config.shadowTiddlers.YourSearchStyleSheet="/***\n!~YourSearchResult Stylesheet\n***/\n/*{{{*/\n.yourSearchResult {\n\tposition: absolute;\n\twidth: 800px;\n\n\tpadding: 0.2em;\n\tlist-style: none;\n\tmargin: 0;\n\n\tbackground: #f0f8ff;\n\tborder: 1px solid DarkGray;\n}\n\n/*}}}*/\n/***\n!!Summary Section\n***/\n/*{{{*/\n.yourSearchResult .summary {\n\tborder-bottom-width: thin;\n\tborder-bottom-style: solid;\n\tborder-bottom-color: #999999;\n\tpadding-bottom: 4px;\n}\n\n.yourSearchRange, .yourSearchCount, .yourSearchQuery   {\n\tfont-weight: bold;\n}\n\n.yourSearchResult .summary .button {\n\tfont-size: 10px;\n\n\tpadding-left: 0.3em;\n\tpadding-right: 0.3em;\n}\n\n.yourSearchResult .summary .chkBoxLabel {\n\tfont-size: 10px;\n\n\tpadding-right: 0.3em;\n}\n\n/*}}}*/\n/***\n!!Items Area\n***/\n/*{{{*/\n.yourSearchResult .marked {\n\tbackground: none;\n\tfont-weight: bold;\n}\n\n.yourSearchItem {\n\tmargin-top: 2px;\n}\n\n.yourSearchNumber {\n\tcolor: #0000FF;\n}\n\n\n.yourSearchTags {\n\tcolor: #3333ff;\n}\n\n.yourSearchText {\n\tcolor: #000080;\n\tmargin-bottom: 6px;\n}\n\n/*}}}*/\n/***\n!!Footer\n***/\n/*{{{*/\n.yourSearchFooter {\n\tmargin-top: 8px;\n\tborder-top-width: thin;\n\tborder-top-style: solid;\n\tborder-top-color: #999999;\n}\n\n.yourSearchFooter a:hover{\n\tbackground: none;\n\tcolor: none;\n}\n/*}}}*/\n/***\n!!Navigation Bar\n***/\n/*{{{*/\n.yourSearchNaviBar a {\n\tfont-size: 16px;\n\tmargin-left: 4px;\n\tmargin-right: 4px;\n\tcolor: black;\n\ttext-decoration: underline;\n}\n\n.yourSearchNaviBar a:hover {\n\tbackground-color: none;\n}\n\n.yourSearchNaviBar .prev {\n\tfont-weight: bold;\n\tcolor: blue;\n}\n\n.yourSearchNaviBar .currentPage {\n\tcolor: #0000FF;\n\ttext-decoration: none;\n}\n\n.yourSearchNaviBar .next {\n\tfont-weight: bold;\n\tcolor: blue;\n}\n/*}}}*/\n";config.shadowTiddlers.YourSearchResultTemplate='<!--\n{{{\n-->\n<span macro="yourSearch if found">\n<!-- The Summary Header ============================================ -->\n<table class="summary" border="0" width="100%" cellspacing="0" cellpadding="0"><tbody>\n  <tr>\n\t<td align="left">\n\t\tYourSearch Result <span class="yourSearchRange" macro="yourSearch itemRange"></span>\n\t\t&nbsp;of&nbsp;<span class="yourSearchCount" macro="yourSearch count"></span>\n\t\tfor&nbsp;<span class="yourSearchQuery" macro="yourSearch query"></span>\n\t</td>\n\t<td class="yourSearchButtons" align="right">\n\t\t<span macro="yourSearch newTiddlerButton"></span>\n\t\t<span macro="yourSearch openAllButton"></span>\n\t\t<span macro="yourSearch closeButton"></span>\n\t</td>\n  </tr>\n</tbody></table>\n\n<!-- The List of Found Tiddlers ============================================ -->\n<div id="yourSearchResultItems" itemsPerPage="25" itemsPerPageWithPreview="10"></div>\n\n<!-- The Footer (with the Navigation) ============================================ -->\n<table class="yourSearchFooter" border="0" width="100%" cellspacing="0" cellpadding="0"><tbody>\n  <tr>\n\t<td align="left">\n\t\tNombre de pages : <span class="yourSearchNaviBar" macro="yourSearch naviBar"></span>\n\t</td>\n\t<td align="right"><span macro="yourSearch version"></span>, <span macro="yourSearch copyright"></span>\n\t</td>\n  </tr>\n</tbody></table>\n<!-- end of the \'tiddlers found\' case =========================================== -->\n</span>\n\n\n<!-- The "No tiddlers found" case =========================================== -->\n<span macro="yourSearch if not found">\n<table class="summary" border="0" width="100%" cellspacing="0" cellpadding="0"><tbody>\n  <tr>\n\t<td align="left">\n\t\tRecherche infructueuse: aucun article trouvé pour <span class="yourSearchQuery" macro="yourSearch query"></span>.\n\t</td>\n\t<td class="yourSearchButtons" align="right">\n\t\t<span macro="yourSearch closeButton"></span>\n\t</td>\n  </tr>\n</tbody></table>\n</span>\n\n\n<!--\n}}}\n-->\n';config.shadowTiddlers.YourSearchItemTemplate="<!--\n{{{\n-->\n<span class='yourSearchNumber' macro='foundTiddler number'></span>\n<span class='yourSearchTitle' macro='foundTiddler title'/></span>&nbsp;-&nbsp;\n<span class='yourSearchTags' macro='foundTiddler field tags 50'/></span>\n<span macro=\"yourSearch if previewText\"><div class='yourSearchText' macro='foundTiddler field text 250'/></div></span>\n<!--\n}}}\n-->";config.shadowTiddlers.YourSearch="<<tiddler [[YourSearch Help]]>>";config.shadowTiddlers["YourSearch Result"]="The popup-like window displaying the result of a YourSearch query.";config.macros.search.handler=myMacroSearchHandler;var checkForOtherHijacker=function(){if(config.macros.search.handler!=myMacroSearchHandler){alert("Message from YourSearchPlugin:\n\n\nAnother plugin has disabled the 'Your Search' features.\n\n\nYou may disable the other plugin or change the load order of \nthe plugins (by changing the names of the tiddlers)\nto enable the 'Your Search' features.")}};setTimeout(checkForOtherHijacker,5000);abego.YourSearch.getStandardRankFunction=function(){return standardRankFunction};abego.YourSearch.getRankFunction=function(){return abego.YourSearch.getStandardRankFunction()};abego.YourSearch.getCurrentTiddler=function(){return currentTiddler};abego.YourSearch.closeResult=function(){closeResult()};abego.YourSearch.getFoundTiddlers=function(){return lastResults};abego.YourSearch.getQuery=function(){return lastQuery};abego.YourSearch.onShowResult=function(useOldResult){highlightHack=lastQuery?lastQuery.getMarkRegExp():null;if(!useOldResult){pager.setItems(getLastResults())}if(!resultElement){resultElement=createTiddlyElement(document.body,"div",yourSearchResultID,"yourSearchResult")}else{if(resultElement.parentNode!=document.body){document.body.appendChild(resultElement)}}refreshResult();highlightHack=null}})()};
//%/
<<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '" [["+tiddler.title+"]] \"Consulter ["+tiddler.title+"]\" [["+tiddler.title+"]] "' begin '"<<tabs tAutoTab "' end '">"+">"' none '"////"'>>
<<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '" [["+tiddler.title.substr(0,4)+"]] \""+tiddler.title+"\" [["+tiddler.title+"]] "' begin '"<<tabs tAutoTab "' end '">"+">"' none '"////"'>>
<<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '" [["+tiddler.title.substr(0,7)+"]] \""+tiddler.title+"\" [["+tiddler.title+"]] "' begin '"<<tabs tAutoTab "' end '">"+">"' none '"////"'>>
<<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '"* [["+tiddler.title+"]] \n"'>><<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '" [["+tiddler.title+"]] \"Consulter ["+tiddler.title+"]\" [["+tiddler.title+"]] "' begin '"<<tabs tAutoTab "' end '">"+">"' none '"//Aucun élément pour le moment//"'>>
<<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '" [["+tiddler.title.substr(0,10)+"]] \"["+tiddler.title+"]\" [["+tiddler.title+"]] "' begin '"<<tabs tAutoTab "' end '">"+">"' none '"//Aucun élément pour le moment//"'>>
<<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '"* [["+tiddler.title+"]]\n"' begin '""' end '""' none '"* Aucune publication pour le moment\n"'>>
<<forEachTiddler where 'tiddler.tags.containsAny(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '(index < 24) ? "|"+tiddler.title.substr(0,10)+"|[["+tiddler.title.substr(13,254)+"|"+tiddler.title+"]]|\n" : ""' begin '"|Date|!$2 |\n"' end '""' none '"* Aucune publication\n"'>>
[[Accueil]][[Main Current]]
{{floatL{
|TablNoBord|k
|@@color:#00F;<html><i class="fa fa-home" aria-hidden="true"></i></html>@@|__[[Accueil]]__ ^^[img[iCSF/flag_fr.png][https://CloudSecurityAlliance.fr]]^^|
|@@color:#00F;<html><i class="fa fa-chalkboard-teacher" aria-hidden="true"></i></html>@@|__[[Présentation|Chapitre Français]]__|
|@@color:#00F;<html><i class="fa fa-info-circle" aria-hidden="true"></i></html>@@|__[[Actualités]]__|
|@@color:#00F;<html><i class="fa fa-blog" aria-hidden="true"></i></html>@@|__[[Blog]]__|
|@@color:#00F;<html><i class="fa fa-book" aria-hidden="true"></i></html>@@|__[[Publications]]__|
|@@color:#00F;<html><i class="fa fa-eye" aria-hidden="true"></i></html>@@|__[[Veille Web]]__|
|@@color:#00F;<html><i class="fa fa-pencil-alt" aria-hidden="true"></i></html>@@|__[[Newsletters]]__|
|@@color:#00F;<html><i class="fa fa-book-reader" aria-hidden="true"></i></html>@@|__[[Références]]__|
|@@color:#00F;<html><i class="fa fa-tools" aria-hidden="true"></i></html>@@|__[[Outils]]__|
|@@color:#00F;<html><i class="fa fa-exclamation-triangle" aria-hidden="true"></i></html>@@|__[[Alertes|Alertes et Vulnérabilités]]__|
|@@color:#00F;<html><i class="fa fa-archive" aria-hidden="true"></i></html>@@|__[[Archives]]__|
|^^→^^|^^[[Contact]]^^|
[img[LinkedIN|iCSF/In.png][LinkedIN]][img[Slack|iCSF/Slack_icon2.png][Slack]][img[Twitter|iCSF/Twitter_icon.png][Twitter]]
<<search 'Moteur de Recherche'>>[img(50%,1px)[iCSF/BluePixel.gif]]<<tiddler RollLeftCol>>[img(50%,1px)[iCSF/BluePixel.gif]]}}}
Chapitre Français •<<tiddler .ToggleLeftSidebar>>•
Cloud Security Alliance
[[myCSS]]
<!--{{{-->
<div class='toolbar' macro='toolbar [[ToolbarCommands::ViewToolbar]]'></div>
<div class='title' macro='view title'></div>
<div class='viewer' macro='view text wikified'></div>
<div class='viewer' macro='tiddler ReplaceDoubleClick'></div>
<div class='tagClear'></div>
<!--}}}-->

|  |!0|!1|!2|!3|!4|!5|!6|!7|!8|!9|
|!0| 0| 1| 2| 3| 4| 5| 6| 7| 8| 9|
|!1| a| b| c| d| e| f| g| h| i| j|
|!2| k| l| m| n| o| p| q| r| s| t|
|!3| u| v| w| x| y| z| A| B| C| D|
|!4| E| F| G| H| I| J| K| L| M| N|
|!5| O| P| Q| R| S| T| U| V| W| X|
|!6| Y| Z| +| =| -| (| )||||
+++*[T0D0] <<tiddler fAll2Tabs with: T0D0>>=== • +++*[AdvancedOptions] <<tiddler AdvancedOptions>>=== •
|2018.11...|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[Microsoft Certifié Hébergeur de Donnees de Santé en France|https://www.lemondeinformatique.fr/actualites/lire-microsoft-certifie-hebergeur-de-donnees-de-sante-en-france-73347.html]]|Azure Healthcare France|
|201.......|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[AWS Certifié Hébergeur de Donnees de Santé en France, Oui mais...|https://www.lemondeinformatique.fr/actualites/lire-aws-certifie-hebergeur-de-donnees-de-sante-oui-mais-maj-74667.html]]|AWS Healthcare France|
/% [img(auto,60px)[Cliquez sur la bannière pour vous enregistrer|iCSF/CCSA19h.jpg][2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]] | %/
/% [img(auto,250px)[Cliquez sur la bannière pour vous enregistrer|iCSF/CCSA19v.jpg][2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]
---- 
__[[EMEA Congress|2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]__
[[18/21 nov. 2019|2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]
[[Berlin, Allemagne|2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]
[img(125px,auto)[Congrès CSA EMEA 2019|iCSF/CSA-EMEA.png][2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]
''[[Cloud & Cyber Security Expo|https://cloudsecurityalliance.fr/go/jBiM/]]''
27/28 nov. 2019
Paris, France
[img(125px,auto)[Cloud & Cyber Security Expo|iCSF/CloudSecurityExpoFrance.png]]
__[[EMEA Congress|2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]__ → Formations les 18 et 19 novembre 2019 à Berlin
__[[EMEA Congress|2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]__ → Conférence les 20 et 21 novembre 2019 à Berlin
__[[Cloud Security Expo|Salon Cloud Security Expo]]__ → Salon et conférences les 27 et 28 novembre 2019 à Paris
%/
/%  %/
/%  %/
//{{{
config.options.txtUserName='CSA-FR';
config.options.chkAnimate=false;
config.options.chkRegExpSearch=false;
config.options.chkCaseSensitiveSearch=false;
config.options.chkOpenInNewWindow=true;
config.messages.tiddlerLinkTooltip="→ %0";
config.messages.externalLinkTooltip="→ %0";
config.options.chkHideSiteTitles=true;
config.macros.search.prompt="Recherche sur ce site";
config.macros.search.successMsg="%1 → %0 article(s)";
config.macros.search.failureMsg="%0 → Aucun article";
config.macros.search.label="Recherche";
merge(config.views.wikified,{ dateFormat: "0DD.0MM.YYYY",});
merge(config.macros.search,{ label: "", prompt: "Moteur de recherche local",});
config.options.chkUseYourSearch=true;
config.options.chkPreviewText=false;
config.options.chkSearchAsYouType=true;
config.options.chkSearchInTitle=true;
config.options.chkSearchInText=true;
config.options.chkSearchInTags=true;
config.options.chkSearchExtendedFields=false;
config.options.txtItemsPerPage=10;
config.options.txtItemsPerPageWithPreview=10;
config.options.chkShowLeftSidebar=true;
config.options.chkDisableWikiLinks=true;
config.options.chkAllowLinksFromShadowTiddlers=true;
config.options.chkDisableNonExistingWikiLinks=true;
config.options.chkSinglePageAutoScroll=true;
config.options.chkSinglePagePermalink=false;
config.options.chkSinglePageMode=false;
config.options.chkTopOfPageMode=true;
config.options.chkBottomOfPageMode=false;
config.options.chkShowBreadcrumbs=true;
config.options.txtBreadcrumbsLimit=8;
config.options.chkReorderBreadcrumbs=true;
config.options.txtBreadcrumbsCrumbSeparator="  <html><i class='fa fa-shoe-prints' aria-hidden='true'></i><i class='fa fa-shoe-prints' aria-hidden='true'></i></html>  ";
config.options.chkBreadcrumbsSave=false;
config.options.chkShowStartupBreadcrumbs=false;
config.options.chkBreadcrumbsReverse=false;
config.options.chkBreadcrumbsLimitOpenTiddlers=true;
config.options.txtBreadcrumbsLimitOpenTiddlers=20;
config.options.chkBreadcrumbsHideHomeLink=false;
config.options.chkCreateDefaultBreadcrumbs=true;
readOnly=true;
config.options.chkHttpReadOnly=true;
config.options.chkBackstage=false;
showBackstage=false;
merge(config.shadowTiddlers,{ ToolbarCommands: '|~ViewToolbar|closeTiddler closeOthers|\n|~EditToolbar|+saveTiddler -cancelTiddler deleteTiddler|',});
merge(config.commands.closeTiddler,{ text: "[fermer]", tooltip: "Fermer cet article" });
merge(config.commands.closeOthers,{ text: "[isoler]", tooltip: "Fermer les autres articles" });
//}}}
/*{{{*/
.col30 {width:30%; float:left; margin-left:1%; margin-right:1%; border-color:#00F; border-style:solid; border-width:3px; }
.col40 {width:40%; float:left; margin-left:1%;}
.col45 {width:45%; float:left; margin-left:1%;}
.col50 {width:50%; float:left; margin-left:1%;}
.clear {clear:both;}
.TablNoBord,
.TablNoBord table,
.TablNoBord td,
.TablNoBord tr,
.TablNoBord th,
.TablNoBord tbody
{ border:0 !important; }
/* {font-size:.70em;} */
body {font-size:.8em;font-family:Verdana,times,serif; margin:0; padding:0;}
pre, .tagged, .tagging, #messageArea, .popup, .tiddlyLink, .button { border-radius: 5px; }
.tiddlyLink { padding: 0px 2px; margin: 0 -2px; }
img[align="left"] { margin-right: .5em; }
img[align="right"] { margin-left: .5em; }
.toolbar {text-align:left; font-size:.7em;}
img {border:2px solid [[ColorPalette::Background]];}
.headerShadow {position:relative; padding:0.5em 0em 1em 1em; left:-1px; top:-1px;}
.headerForeground {position:absolute; padding:0.5em 0em 1em 1em; left:0px; top:0px;}
.headerShadow .right { position: absolute; top: 0; }
.headerShadow .right { right: 0; }
.headerForeground .right { display: none; }
/* InlineTabs */
.tabSelected{ font-weight:bold; font-size:125%; color:[[ColorPalette::PrimaryDark]]; background:[[ColorPalette::TertiaryPale]]; border-left:2px solid [[ColorPalette::PrimaryMid]]; border-top:2px solid [[ColorPalette::PrimaryLight]]; border-right:2px solid [[ColorPalette::PrimaryMid]]; border-bottom-style:2px solid [[ColorPalette::PrimaryMid]]; }
.tabContents {color:[[ColorPalette::PrimaryDark]]; background:[[ColorPalette::Background]]; border:2px solid [[ColorPalette::PrimaryMid]];}
/* StyleSheetFirstLetter */
.firstletter{ float:left; width:0.6em; font-size:250%; font-family:Verdana,times,serif; line-height:60%; color:#00f !important; background:inherit !important; }
.firstletterC{ float:center; width:0.6em; font-size:250%; line-height:60%; color:#00f !important; background:inherit !important; }
.FirstLetter{ width:0.6em; font-size:150%; font-family:Verdana,times,serif; line-height:60%; !important; background:inherit !important; }
/* StyleSheetTableList */
.viewer ul {margin-top: 0; margin-bottom: 0;}
.viewer {text-align: justify;}
.viewer th {background:[[ColorPalette::TertiaryPale]]; color:[[ColorPalette::PrimaryMid]];}
/* Alignement */
.floatL { display:block;text-align:left; }
.floatR { display:block;text-align:right; }
.floatC { display:block;text-align:center; }
.Table98{width:98%}
/* NestedSlidersPlugin */
.floatingPanel { z-index:700; padding:1em; margin:0em; border:1px solid; -moz-border-radius:1em; font-size:8pt; text-align:left; }
.floatingPanel hr { margin:2px 0 1px 0; padding:0; }
#sidebarOptions .sliderPanel { margin:0; padding:0; font-size:1em; background:transparent; }
#sidebarOptions .sliderPanel a { font-weight:normal; }
#sidebarOptions .sliderPanel blockquote { margin:0;padding:0;margin-left:1em; border-left:1px dotted; padding-left:1em }
.selected .floatingPanel .button,
.selected .floatingPanel a:link,
.selected .floatingPanel a:hover,
.selected .floatingPanel a:visited,
.floatingPanel .button,
.floatingPanel a:link,
.floatingPanel a:hover,
.floatingPanel a:visited { color:[[ColorPalette::PrimaryDark]] !important; }
.QOTD { color:#00f !important; background:inherit !important; }
.horizTag li.listTitle { display:none }
.horizTag li { display: inline; font-size:90%; }
.horizTag ul { display:inline; margin:0px; padding:0px;}
.viewer td { vertical-align: top; }
.viewer th { vertical-align: top; }
.viewer dl { margin: 0; }
/*}}}*/
[img(400px,4px)[iCSF/BluePixel.gif]]
[img(200px,auto)[iCSF/Email-CSA_FR.png]]
|Table98|k
| <<tiddler RollHeader>> |
@@color:#00F;<html><i class="fa fa-chalkboard-teacher fa-2x" aria-hidden="true"></i></html>@@ — @@font-size:175%;[[Chapitre Français]]@@ /%
<br>@@font-size:80%;Présentation du [[Chapitre Français]] de la [[Cloud Security Alliance]]@@</html> %/
@@color:#00F;<html><i class="fa fa-info-circle fa-2x" aria-hidden="true"></i</html>@@ — @@font-size:175%;[[Actualités]]@@ /%
<br>@@font-size:80%;[[Actualités]] ''CSA'' et du [[Chapitre Français]]@@</html> %/
@@color:#00F;<html><i class="fa fa-blog fa-2x" aria-hidden="true"></i</html>@@ — @@font-size:175%;[[Blog]]@@ /%
<br>@@font-size:80%;[[Articles de blog|Blog]] ''CSA'' et du [[Chapitre Français]]@@</html> %/
@@color:#00F;<html><i class="fa fa-book fa-2x" aria-hidden="true"></i</html>@@ — @@font-size:175%;[[Publications CSA|Publications]]@@ /%
<br>@@font-size:80%;[[Publications]] ''CSA'' : "[[Cloud Controls Matrix]]" et "[[Security Guidance|Groupe de Travail - Security Guidance]]"@@</html> %/
@@color:#00F;<html><i class="fa fa-eye fa-2x" aria-hidden="true"></i</html>@@ — @@font-size:175%;[[Veille Web]]@@ /%
<br>@@font-size:80%;[[Veille Web]] hebdomadaire sur la sécurité du Cloud@@</html> %/
@@color:#00F;<html><i class="fa fa-pencil-alt fa-2x" aria-hidden="true"></i</html>@@ — @@font-size:175%;[[Newsletters]]@@ /%
<br>@@font-size:80%;[[Newsletters]] hebdomadaires@@</html> %/
@@color:#00F;<html><i class="fa fa-book-reader fa-2x" aria-hidden="true"></i</html>@@ — @@font-size:175%;[[Références]]@@ /%
<br>@@font-size:80%;Documents et sites de [[références|Références]]@@</html> %/
@@color:#00F;<html><i class="fa fa-tools fa-2x" aria-hidden="true"></i</html>@@ — @@font-size:175%;[[Outils]]@@ /%
<br>@@font-size:80%;[[Outils]] et utilitaires sécurité, tableaux de bords@@</html> %/
@@color:#00F;<html><i class="fa fa-exclamation-triangle fa-2x" aria-hidden="true"></i</html>@@ — @@font-size:175%;[[Alertes|Alertes et Vulnérabilités]]@@ /%
<br>@@font-size:80%;[[Alertes|Alertes et Vulnérabilités]] de sécurité et vulnérabilités@@</html> %/
@@color:#00F;<html><i class="fa fa-archive fa-2x" aria-hidden="true"></i></html> —@@ @@font-size:175%;[[Archives]]@@ /%
<br>@@font-size:80%;[[Archives]] complètes depuis 2018 ([[partielles|Veille Web]] de 2009 à 2017)@@</html> %/
[img(20px,auto)[LinkedIN|iCSF/In.png][LinkedIN]] — @@font-size:175%;[[LinkedIN]]@@ /%

@@font-size:80%;Rejoignez nous sur [[LinkedIN]]@@ %/
[img(20px,auto)[Slack|iCSF/Slack_icon2.png][Slack]] — @@font-size:175%;[[Slack]]@@ /%

@@font-size:80%;Rejoignez nous sur [[Slack]]@@ %/
|Table98|k
| <<tiddler [[ToC-1]]>> | <<tiddler [[ToC-2]]>> | <<tiddler [[ToC-3]]>> |
| <<tiddler [[ToC-4]]>> | <<tiddler [[ToC-5]]>> | <<tiddler [[ToC-6]]>> |
| <<tiddler [[ToC-7]]>> | <<tiddler [[ToC-8]]>> | <<tiddler [[ToC-9]]>> |
| <<tiddler [[ToC-A]]>> | <<tiddler [[ToC-B]]>> | <<tiddler [[ToC-C]]>> |
|>|>| ^^<<tiddler [[Categories]]>>^^ |
[img(50%,1px)[iCSF/BluePixel.gif]]
<<tabs tHisto 'Archives 2019' 'Archives 2019' [[Archives 2019]] 'Archives 2018' 'Archives 2018' [[Archives 2018]] >>
<<tiddler fAll2Tabs7 with: _Histo19>><<tiddler .ReplaceTiddlerTitle with: [[Archives 2019]]>>
<<tiddler fAll2Tabs7 with: _Histo18>><<tiddler .ReplaceTiddlerTitle with: [[Archives 2018]]>>
Catégories : [[CAIQ]] • [[CCAK]] • [[CCM]] • [[CCSK]] • [[Cryptographie]] • [[ERP]] • [[Incidents]] • [[IoT]] • [[Menaces]] • [[Panorama]] • [[RGPD]] • [[Santé|Publications - Santé]] • [[SDP]] • [[STAR]] • [[Vulnérabilités]] •
!Le [[Chapitre Français|CSA-FR]] de la [[Cloud Security Alliance]]
[>img(200px,auto)[iCSF/cloud-security-alliance.png]]
Le [[Chapitre Français|CSA-FR]] de la [[Cloud Security Alliance]] a été créé en décembre 2010 par ''[[Olivier Caleff|https://www.linkedin.com/in/caleff]]'' et ''[[Pierre Vacherand|https://www.linkedin.com/in/pierrevacherand/]]''.
Après un bon début, le [[Chapitre français|CSA-FR]] a tourné au ralenti entre 2013 et 2017.
Les activités se sont concentrées autour de participations et contributions à des événements de la [[Cloud Security Alliance]] en Europe, à des participations dans des groupes de travail de la [[Cloud Security Alliance]], et à une participation très active dans le domaine de la formation (voir ci-dessous)
En 2018, les activités reprennent avec :
* La participation à deux salons (Mars et Novembre 2018)
* La poursuite des partenariats pour les activités de formation
* L'animation du groupe LinkedIn : https://www.linkedin.com/groups/3758242
* La préparation de la relance des réunions des membres du [[Chapitre français|CSA-FR]]
__Contact :__ https://CloudSecurityAlliance.fr et [img(200px,auto)[iCSF/Email-CSA_FR.png]]
!Les partenariats
<<tiddler [[Partenariats - ISEP-FC - Masteres Spécialisés]]>>
[>img(200px,auto)[iCSF/cloud-security-alliance.png]]La [[Cloud Security Alliance]] (CSA) est une organisation à but non lucratif qui a pour mission :
* de promouvoir de bonnes pratiques en matière d'assurance de la sécurité dans le Cloud Computing
* de fournir des formations sur les utilisations du Cloud Computing pour aider à sécuriser toutes les autres formes d'informatique
La [[Cloud Security Alliance]] est dirigée par une vaste coalition de praticiens de l'industrie, d'entreprises, d'associations et d'autres intervenants clés.
[img(25%,1px)[iCSF/BluePixel.gif]]
__Historique__
[>img[CSA|iCSA/CSA.ico]]Les enjeux et opportunités du cloud computing ont fait l'objet d'une attention particulière en 2008 au sein de la communauté de la sécurité de l'information.
Lors du forum CISO de l'ISSA à Las Vegas, en novembre 2008, le concept de d'une Alliance pour la sécurité du Cloud Computing ([[Cloud Security Alliance]]) a vu le jour. Après une présentation des tendances émergentes par ''[[Jim Reavis|https://www.linkedin.com/in/jimreavis/]]'', dont un appel à l'action pour la sécurisation du cloud computing, ''Jim Reavis'' et ''[[Nils Puhlmann|https://www.linkedin.com/in/npuhlmann/]]'' ont présenté la mission et la stratégie initiales de la CSA. Une série de réunions organisationnelles avec des chefs de file de l'industrie au début de décembre 2008 a officialisé la fondation de la CSA.
Le travail de sensibilisation auprès de la communauté de la sécurité de l'information pour créer un support de travail initial en vue de la Conférence RSA 2009 a donné lieu à des échanges entre des dizaines de bénévoles pour la recherche, l'auteur, la rédaction et la révision du premier livre blanc.
[img(25%,1px)[iCSF/BluePixel.gif]]
__Mission__
[>img[CSA|iCSA/CSA.ico]]Promouvoir l'utilisation des meilleures pratiques pour fournir une assurance de sécurité dans le Cloud Computing, et fournir de l'éducation sur les utilisations du Cloud Computing pour aider à sécuriser toutes les autres formes d'informatique.
[img(25%,1px)[iCSF/BluePixel.gif]]
|!Objet|!→ Liens|
|Site Web ''CSA''
 • Flux RSS|→ https://CloudSecurityAlliance.org
→ https://cloudsecurityalliance.org/feed/ | |Annonces|→ https://cloudsecurityalliance.org/articles/ | |Presse|→ https://blog.cloudsecurityalliance.org/press-coverage/ | |Blog
 • Flux RSS|→ https://blog.cloudsecurityalliance.org
→ https://blog.cloudsecurityalliance.org/feed/ | |Recherche
 • Commentaires|→ https://cloudsecurityalliance.org/research/
→ https://cloudsecurityalliance.org/research/contribute/ | |Groupes de travail|→ https://cloudsecurityalliance.org/meetings/ | |Publications|→ https://cloudsecurityalliance.org/research/artifacts/ | |Registre ''STAR''|→ https://cloudsecurityalliance.org/star/registry/ | |Aspects ''RGPD''|→ https://gdpr.cloudsecurityalliance.org/ | |Formation ''CCAK''|→ https://cloudsecurityalliance.org/education/ccak/ | |Formation ''CCSK''|→ https://ccsk.cloudsecurityalliance.org/ | |!|!| |Profil __LinkedIN__|→ https://www.linkedin.com/groups/1864210/profile | |Flux __Twitter__|→ https://twitter.com/cloudsa |
{{floatC{[img[iCSF/Email-CSA_FR.png]]
[img[iCSF/Cloud_Question.png]]
}}}
[img(40%,1px)[iCSF/BluePixel.gif]][img[iCSF/In.png][https://www.linkedin.com/groups/3758242]] [img(40%,1px)[iCSF/BluePixel.gif]]
Lien vers le groupe ''LinkedIN'' du [[Chapitre Français]] de la [[Cloud Security Alliance]]
:→ https://www.linkedin.com/groups/3758242
[>img(200px,auto)[iCSF/cloud-security-alliance.png]]Le [[Chapitre Français]] de la [[Cloud Security Alliance]] est une association formée pour faire la promotion des meilleures pratiques de sécurité au sein des infrastructures Cloud Computing.
Il se charge notamment :
* d'adapter certains documents de la [[Cloud Security Alliance]] aux spécificités françaises (notamment réglementaires)
* de favoriser les bonnes pratiques de sécurité auprès des prestataires et founisseurs de Cloud français et auprès des Entreprises qui batissent des Clouds Privés
* de publier de nouvelles recommandations de sécurité relatives au Cloud Computing
* de traduire certains documents de la [[Cloud Security Alliance]] en français
* de mener des actions pour former et évangéliser sur la sécurité du Cloud Computing
* de participer à la communauté des chapitres européens regroupés sous l'appellation "''CSA EMEA''"[>img(200px,auto)[iCSF/CSA-EMEA.png]]
* d'établir des relations avec la presse et avec des groupes de travail similaires traitant soit du Cloud Computing, soit de la Sécurité
* de participer à tout type d'événements ou de conférences liés à la sécurité du Cloud Computing
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler [[Partenariats - ISEP-FC - Masteres Spécialisés]]>>
Le site de la [[Cloud Security Alliance]] est https://www.CloudSecurityAlliance.org 
<<QOTD RolledHeader 2000 noclick norandom>>
<<QOTD RolledLeftCol 4000 noclick norandom>>
<<QOTD RolledMainW 10000 noclick norandom>>
[img(40%,1px)[iCSF/BluePixel.gif]][img[Lien vers l'espace Slack du Chapitre Français|iCSF/Slack_ani.gif][https://csafr.slack.com/]] [img(40%,1px)[iCSF/BluePixel.gif]]
Lien vers l'espace ''Slack'' du [[Chapitre Français]] de la [[Cloud Security Alliance]]
:→'' https://csafr.slack.com ''
[img(40%,1px)[iCSF/BluePixel.gif]][img[Lien vers le compte Twitter du Chapitre Français|iCSF/Twitter_icon.png][https://twitter.com/cloudsaFR]] [img(40%,1px)[iCSF/BluePixel.gif]]
Lien vers le flux Twitter du [[Chapitre Français]] de la [[Cloud Security Alliance]]
:→ https://twitter.com/cloudsaFR
[img(40%,1px)[iCSF/BluePixel.gif]][img[Lien vers le compte Twitter du Chapitre Français|iCSF/Twitter_icon.png][https://twitter.com/cloudsaFR]] [img(40%,1px)[iCSF/BluePixel.gif]]
__Autres flux Twitter à suivre :__
* Flux de la [[Cloud Security Alliance]]
:→ https://twitter.com/cloudsa
* Flux ''CSACloudbytes''
:→ https://twitter.com/hashtag/CSACloudbytes
<<tiddler fAll2Tabs7 with: _Veille19>><<tiddler .ReplaceTiddlerTitle with: "Veille Web Cloud et Sécurité">>
<<tiddler [[Veille.20xx.Archives]]>>
<<tiddler fAll2Tabs4 with: _Veille1x>>
Les archives sont organisées par année, de 2018 à 2009.
|!@@font-size:125%;Décembre 2019@@ — dernière mise à jour le @@font-size:125%;@@ |!@@color:#00F;font-size:112%;<html><i class="fa fa-question-circle fa-2x" aria-hidden="true"></i></html>@@ Le savez-vous ? |
|@@color:#00F;<html><i class="fa fa-eye fa-2x" aria-hidden="true"></i></html>@@ __@@color:#009;font-size:112%;''[[Veille Web Décembre 2019|2019.12.31 - Veille - Décembre 2019]]''@@__ 

<<tiddler fAll2List with: 201912","_Show_ >>
@@color:#00F;<html><i class="fa fa-eye fa-2x" aria-hidden="true"></i></html>@@ __@@color:#009;font-size:112%;''[[Veille Web Novembre 2019|2019.11.30 - Veille - Novembre 2019]]''@@__

<<tiddler fAll2List with: 201911","_Show_ >> |<<tiddler RollMainW>> | |>| Archives du site et historique : → [[ici|Archives]] ← | /% |<<tiddler fAll2List with: 201910","_Show_ >> [img(25%,1px)[iCSF/BluePixel.gif]]|~| %/ /% |@@color:#00F;<html><i class="fa fa-eye fa-2x" aria-hidden="true"></i></html>@@ __@@color:#009;font-size:112%;''[[Veille Web Octobre 2019|2019.10.31 - Veille - Octobre 2019]]''@@__

<<tiddler fAll2List with: 201910","_Show_ >> [img(25%,1px)[iCSF/BluePixel.gif]]|~| %/ /% — @@color:#00F;<html><i class="fa fa-exclamation-triangle fa-2x" aria-hidden="true"></i></html>@@__[[Alertes Novembre 2019|2019.11.30 - Alertes]]__ %/ <<tiddler .ReplaceTiddlerTitle with: [[Le suivi et les dernières informations]]>>
__[[Veille Cloud et Sécurité|2019.11.30 - Veille - Novembre 2019]]__ → l'actualité
----
__[[Actualités CSA|2019.11.Actu]]__ → l'actualité Cloud Security Alliance France et monde
----
__[[Alertes Cloud et Sécurité|2019.11.30 - Alertes]]__ → les alertes
----
__[[Publications CSA|2019.11.Publ]]__ → les publications de la Cloud Security Alliance
----
__[[Newsletters Hebdomadaires|2019.11.NewsL]]__ → nouveautés et veille hebdomadaire
----
__[[Blog CSA|2019.11.Blog]]__ → les articles de Blog du [[Chapitre Français]] et de la [[Cloud Security Alliance]]
----
__[[Sécurité@Cloud|Forum Sécurité@Cloud]]__ → Salon et conférences les 18 et 19 mars 2020 à Paris
----
Espace [[Slack]] du [[Chapitre Français]] : ''[[csafr.slack.com|https://csafr.slack.com/]]''
[img[Lien vers l'espace Slack du Chapitre Français|iCSF/Slack_ani.gif][https://csafr.slack.com/]]''[[csafr.slack.com|https://csafr.slack.com/]]''
----
L'espace __[[Slack]]__ du [[Chapitre Français]] de la [[Cloud Security Alliance]]
----
''[[Sécurité@Cloud|https://cloudsecurityalliance.fr/go/k3iE/]]''
18/19 mars 2020
Paris, France
[img(125px,auto)[Sécurité@Cloud|iCSF/ForumSecuriteCloud-2.jpg]]
----
__Références__
[[Cloud Controls Matrix]]
[img(125px,auto)[CCM|iCSA/CAOBCCM.png][Cloud Controls Matrix]]
|<<tiddler [[LatestWeeklyNewsletter]]>> |
----
<<tiddler [[LatestMonthlyUpdates]]>>
----
|<<tiddler [[Top Articles]]>> |
----
|TablNoBord|k
|>|background-color:#00F; @@color:#FFF;''La galaxie CSA''@@ |
|background-color:#EEF;[img(100px,auto)[CCM|iCSA/CAOBCCM.png][CCM]]|background-color:#EEF;[img(100px,auto)[Menaces|iCSA_/TopThreats_logo.png][Menaces]]|
|background-color:#EEF;[img(100px,auto)[CCSK|iCSA/H8UBCCSK.png][CCSK]]|background-color:#EEF;[img(100px,auto)[CAIQ|iCSA_/CSA-CAI.png][CAIQ]]|
|background-color:#EEF;[img(100px,auto)[CCSK|iCSA/CCAK.png][CCAK]]|background-color:#EEF;|
----
''La galaxie CSA''
[img(400px,auto)[iCSA_/CSAGalaxy.png]]
----
<<tiddler [[CCM - Domaines]]>>
----
<<tiddler [[CCM - Référentiels]]>>
----
@@color:#00F;font-size:112%;<html><i class="fa fa-arrow-circle-right fa-2x" aria-hidden="true"></i></html>@@ Vous pouvez nous joindre sur [[LinkedIN]] et [[Slack]]
<<tiddler [[LinkedIN]]>>
<<tiddler [[Slack]]>>
!Les articles les plus lus en 2019 :
# 2019.05.14 : [[Analyse du DHS/CISA sur les risques liés à Office 365|2019.05.14 - Blog : Analyse du DHS/CISA sur les risques liés à Office 365]]+++*[»]> <<tiddler [[2019.05.14 - Blog : Analyse du DHS/CISA sur les risques liés à Office 365]]>>=== 
# 2019.08.06 : [[Top Threats to Cloud Computing: Egregious Eleven|2019.08.06 - Publication : 'Top Threats to Cloud Computing: Egregious Eleven']]+++*[»]> <<tiddler [[2019.08.06 - Publication : 'Top Threats to Cloud Computing: Egregious Eleven']]>>=== 
# 2019.08.03 : [[Mise à jour et compléments pour la CCM v3.0.1|2019.08.03 - Publication : Mise à jour et compléments pour la CCM v3.0.1]]+++*[»]> <<tiddler [[2019.08.03 - Publication : Mise à jour et compléments pour la CCM v3.0.1]]>>=== 
# 2019.07.01 : [[Utiliser CAIQ-Lite pour évaluer des prestataires ou fournisseurs|2019.07.01 - Blog : Utiliser CAIQ-Lite pour évaluer des prestataires ou fournisseurs]]+++*[»]> <<tiddler [[2019.07.01 - Blog : Utiliser CAIQ-Lite pour évaluer des prestataires ou fournisseurs]]>>=== 
# 2019.02.16 : [[Compromission de Visma, prestataire Cloud en Norvège|2019.02.16 - Blog : Compromission de Visma, prestataire Cloud en Norvège]]+++*[»]> <<tiddler [[2019.02.16 - Blog : Compromission de Visma, prestataire Cloud en Norvège]]>>=== 
[img(25%,1px)[iCSF/BluePixel.gif]]
Arrêt par Orange → offre Flex Engine (lancée en juin 2017)
Lancement en 2012 - https://www.zdnet.fr/actualites/retour-vers-le-futur-cloudwatt-et-numergy-les-souverains-descendent-du-nuage-39813666.htm
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201912>>
<<tiddler fAll2Tabs10 with: VeilleM","_201912>>
|!Décembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|Aucune alerte pour le moment|
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Décembre 2019]]>>
<<tiddler fAll2LiTabs with: NewsL","201912>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Décembre 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Décembre 2019]]>><<tiddler fAll2LiTabs with: Actu","201912>>
<<tiddler fAll2LiTabs with: Blog","201912>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Décembre 2019]]>>
<<tiddler fAll2LiTabs with: Publ","201912>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Décembre 2019]]>>
<<tiddler [[2019.12.08 - Newsletter Hebdomadaire]]>>
<<tiddler fAny2List16 with: '201911","201912' 'Dernières mises à jour'>>
!1 - Les nouveautés CSA de la semaine du 9 au 15 décembre 2019 [>img[iCSF/cloud-security-alliance-fr.png]]
/%  → * __''À lire'' :__ Article "" sur le site XXX +++*[»]> ... === %/
!2 - Veille Web
La +++*[Veille Web]> <<tiddler [[2019.12.15 - Veille Hebdomadaire]]>>=== avec plus de XX liens
* 
!3 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Décembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.12.06|
!1 - Les nouveautés CSA de la semaine du 1^^er^^ au 8 décembre 2019 [>img[iCSF/cloud-security-alliance-fr.png]]
* Publication : ''Recommandations Cloud'' pour les entités gouvernementales danoises +++*[»]> <<tiddler [[2019.12.07 - Publication : Recommandations Cloud pour les entités gouvernementales danoises]]>> === 
* Actu : Nouvelle certification ''Cloud Auditing Knowledge'' (''CCAK'') +++*[»]> <<tiddler [[2019.12.04 - Actu : Nouvelle certification 'Cloud Auditing Knowledge (CCAK)']]>> === 
* Actu : Appel à commentaires, document "''Cloud Incident Response Framework – A Quick Guide''" +++*[»]> <<tiddler [[2019.11.28 - Actu : Appel à commentaires, document 'Cloud Incident Response Framework – A Quick Guide']]>>=== 
* Actu : Appel à commentaires, document "''Hybrid Cloud and Its Associated Risks''" +++*[»]> <<tiddler [[2019.11.28 - Actu : Appel à commentaires, document 'Hybrid Cloud and Its Associated Risks']]>>=== 
* Actu : Appel à commentaires, document "''CloudAbuse Working Group Charter''" +++*[»]> <<tiddler [[2019.10.29 - Actu : Appel à commentaires, document 'CloudAbuse Working Group Charter']]>>=== 
!2 - Veille Web
La +++*[Veille Web]> <<tiddler [[2019.12.01 - Veille Hebdomadaire]]>>=== avec plus de 60 liens
* À savoir : ''BlackDirect'' (//Microsoft and Azure Account Takeover//) +++*[»]> 
|2019.12.02|//CyberArk//|[[BlackDirect: Microsoft Azure Account Takeover|https://www.cyberark.com/threat-research-blog/blackdirect-microsoft-azure-account-takeover/]]|Azure OAuth|
|2019.12.02|//CyberArk//| → Site Web [[BlackDirect|https://black.direct/]]|Azure OAuth|
|2019.12.02|//Threatpost//| → [[Microsoft OAuth Flaw Opens Azure Accounts to Takeover|https://threatpost.com/microsoft-oauth-flaw-azure-takeover/150737/]]|Azure OAuth|
|2019.12.05|CISO Mag| → [[Security Flaw in Microsoft Azure Lets Hackers Control Azure Accounts|https://www.cisomag.com/security-flaw-in-microsoft-azure-lets-hackers-control-azure-accounts/]]|Azure OAuth|
=== 
* Incidents : encore un prestataire victime de rançongiciel (CyrusOne), Mixcloud
* Annonces : ''AWS IAM Access Analyzer for S3'', Amazon Detective et AWS Nitro Enclaves, premier visa ANSSI ''SecNumCloud'' attribué à ''3Ds Outscale''
* Certification : Document de l'ENISA sur les certifications Cloud, en lien avec le groupe de travail ''CSPCERT'' +++*[»]> 
|2019.12.02|ENISA|![[Cybersecurity certification: lifting the EU into the cloud|https://www.enisa.europa.eu/news/enisa-news/cybersecurity-certification-lifting-the-eu-into-the-cloud]]|Certification|
|2019.12.02|ENISA| → [[CSPCERT WG - Recommendations for the implementation of the CSP Certification scheme|https://drive.google.com/file/d/1J2NJt-mk2iF_ewhPNnhTywpo0zOVcY8J/view]]|Certification|
=== 
* Divers : sécurité d'AzureAD, groupes O365
!3 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Décembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.12.06|
|2019.12.06|Maarten Goet|[[Azure Sentinel: advanced multistage attack detection - real machine learning for the real world|https://medium.com/wortell/advanced-multistage-attack-detection-real-machine-learning-for-the-real-world-2d9548276ea1]]|Azure_Sentinel|
|2019.12.06|ComputerWeekly|[[Security Think Tank: Is data more or less secure in the cloud?|https://www.computerweekly.com/opinion/Security-Think-Tank-Is-data-more-or-less-secure-in-the-cloud]]|Misconfigurations Controls|
|2019.12.06|//PaloAlto Networks//|[[How Cloud Native Security Platforms Can Rescue Cloud Native|https://blog.paloaltonetworks.com/2019/12/cloud-native/]]|Cloud_Native|
|>|>|>|!2019.12.05|
|2019.12.05|The Register|[[Kubernetes? 'I don't believe in one tool to rule the world,' says AWS' Sassy Jassy|https://www.theregister.co.uk/2019/12/05/kubernetes_aws_ceo/]]|Kubernetes|
|2019.12.04|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Cloud : les architectes réseau doivent faire preuve d'adaptabilité|https://www.silicon.fr/avis-expert/cloud-les-architectes-reseau-doivent-faire-preuve-dadaptabilite]]|Networks|
|2019.12.05|SecureCloudBlog|[[AAD Security made easy: Check your Azure AD Security with One-Liner (AZSK.AAD)|https://securecloud.blog/2019/12/04/aad-security-made-easy-check-youre-azure-ad-security-with-one-liner-azsk-aad/]]|AzureAD|
|2019.12.05|//SEKOIA//[>img[iCSF/flag_fr.png]]|[[Cloud Act : entre mythes et réalités|https://medium.com/@Sekoia_team/cloud-act-entre-mythes-et-r%C3%A9alit%C3%A9s-21eb1371a7ab]]|CLOUD_Act|
|2019.12.05|//CyrusOne//|[[Managed Service Division of CyrusOne Addresses Ransomware Incident|http://investor.cyrusone.com/news-releases/news-release-details/managed-service-division-cyrusone-addresses-ransomware-incident]]|Outage Ransomware CyrusOne|
|2019.12.05|ZDnet| → [[Ransomware attack hits major US data center provider|https://www.zdnet.com/article/ransomware-attack-hits-major-us-data-center-provider/]]|Outage Ransomware CyrusOne|
|2019.12.05|CIO Dive| → [[CyrusOne hit by REvil ransomware, impacting 6 managed service customers|https://www.ciodive.com/news/cyrusone-ransomware-REvil/568549/]]|Outage Ransomware CyrusOne|
|2019.12.06|Bleeping Computer| → [[U.S. Data Center Provider Hit by Ransomware Attack|https://www.bleepingcomputer.com/news/security/us-data-center-provider-hit-by-ransomware-attack/]]|Outage Ransomware CyrusOne|
|2019.12.05|//GoDaddy//|[[Securing the Cloud: The GoDaddy Way|https://fr.godaddy.com/engineering/2019/12/05/securing-the-cloud/]]|Implementation|
|2019.12.05|//Microsoft//|[[Auto renewal for Office 365 groups expiration policy now available|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Auto-renewal-for-Office-365-groups-expiration-policy-now/ba-p/1022398]]|O365|
|2019.10.24|//Microsoft//| → [[Configure the expiration policy for Office 365 groups|https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-lifecycle]]|O365|
|2019.12.05|//Eplexity//|[[Practical Approaches to Long-Term Cloud-Native Security|https://devops.com/practical-approaches-to-long-term-cloud-native-security/]]|Strategy|
|2019.12.05|//Gigamon//|[[What Is Hybrid Cloud? Advantages and Disadvantages|https://blog.gigamon.com/2019/12/05/what-is-hybrid-cloud-advantages-and-disadvantages/]]|Hybrid_Cloud|
|2019.12.05|//Managed Methods//|[[K-12 Content Filtering & Cloud Security: Why You Need Both|https://managedmethods.com/blog/k-12-content-filtering-cloud-security-why-you-need-both/]]|Filtering|
|2019.12.05|//Caylent//|[[How to use AWS Federated Identities with Amazon EKS|https://caylent.com/how-to-use-aws-federated-identities-with-amazon-eks]]|Federated_Identities AWS|
|>|>|>|!2019.12.04|
|2019.12.04|Silicon.fr[>img[iCSF/flag_fr.png]]|[[SecNumCloud : l'ANSSI décerne le premier visa à 3DS Outscale|https://www.silicon.fr/secnumcloud-lanssi-decerne-le-premier-visa-a-3ds-outscale-328357.html]]|SecNumCloud Outscale|
|2019.12.04|!Silicon.fr[>img[iCSF/flag_fr.png]]|[[Cloud, sécurité des données et conteneurs : les prédictions technologiques pour 2020|https://www.silicon.fr/avis-expert/cloud-securite-des-donnees-et-conteneurs-les-predictions-technologiques-pour-2020]]|Predictions|
|2019.12.04|Dark Reading|[[Navigating Security in the Cloud|https://www.darkreading.com/cloud/navigating-security-in-the-cloud/a/d-id/1336477]]|Best_Practices|
|2019.12.04|SecurityWeek|[[Cloud(y) with a Chance of a Data Breach|https://www.securityweek.com/cloudy-chance-data-breach]]|Risks|
|2019.12.04|//PaloAlto Networks//|[[Perimeter Is Where Your Workload Is: Creating Policy Abstracted from IP Addressing|https://blog.paloaltonetworks.com/2019/12/network-data-center-security/]]|Policy Implementation|
|2019.12.04|//Malware Bytes//|[[Explained: What is containerization?|https://blog.malwarebytes.com/explained/2019/12/explained-what-is-containerization/]]|Containers|
|2019.12.04|//Google//|[[Last month today: November on GCP|https://cloud.google.com/blog/products/gcp/last-month-today-november-2019-on-gcp]]|GCP|
|2019.12.04|//Checkpoint//|[[How is your Kubernetes Security Posture?|https://blog.checkpoint.com/2019/12/04/how-is-your-kubernetes-security-posture/]]|Kubernetes Security_Posture|
|2019.12.04|//AWS//|[[Avoid ransomware by moving to the cloud, says AWS Public Sector boss|https://www.zdnet.com/article/avoid-ransomware-by-moving-to-the-cloud-says-aws-public-sector-boss/]]|AWS Ransomware|
|2019.12.04|//Tripwire//|[[PSA: Beware of Exposing Ports in Docker|https://www.tripwire.com/state-of-security/devops/psa-beware-exposing-ports-docker/]]|Docker Misconfiguration|
|2019.12.04|//FireEye//|[[FireEye's cloud security capabilities now available on AWS|https://www.helpnetsecurity.com/2019/12/04/fireeye-amazon-web-services/]]|FireEye AWS|
|>|>|>|!2019.12.03|
|2019.12.03|Container Journal|[[Report: Kubernetes Use on the Rise |https://containerjournal.com/topics/container-ecosystems/report-kubernetes-use-on-the-rise/]]|Kubernetes|
|2019.12.03|CISO Mag|[["AWS" Hacker Attacks Online Music Service Mixcloud|https://www.cisomag.com/aws-hacker-attacks-online-music-service-mixcloud/]]|Attacks|
|2019.12.03|Dark Reading|[[Leveraging the Cloud for Cyber Intelligence|https://www.darkreading.com/cloud/leveraging-the-cloud-for-cyber-intelligence-/a/d-id/1336457]]|Cyber_Intelligence|
|2019.12.03|CSO|[[How to evaluate a CASB|https://www.csoonline.com/article/3454611/how-to-evaluate-a-casb.html]]|CASB|
|2019.12.03|//Microsoft//|[[Microsoft Security - a Leader in 5 Gartner Magic Quadrants|https://www.microsoft.com/security/blog/2019/12/03/microsoft-security-leader-5-gartner-magic-quadrants/]]|CASB|
|2019.12.03|//Microsoft//|[[Azure AD Domain Services classic migration now available|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Azure-AD-Domain-Services-classic-migration-now-available/ba-p/1024783]]|AzureAD|
|2019.12.03|//AWS//|[[Easily Manage Shared Data Sets with Amazon S3 Access Points|https://aws.amazon.com/blogs/aws/easily-manage-shared-data-sets-with-amazon-s3-access-points/]] ([[podcast|https://d2908q01vomqb2.cloudfront.net/polly/da4b9237bacccdf19c0760cab7aec4a8359010b0amazon_polly_34136.mp3]])|AWS S3|
|2019.12.03|//AWS//| → [[AWS announces three new cloud security products|https://siliconangle.com/2019/12/03/aws-announces-three-new-products-focused-allowing-customers-operate-securely/]]|AWS S3|
|2019.12.03|//AWS//| → [[Amazon S3 Access Points|https://aws.amazon.com/s3/features/access-points/]]|AWS S3|
|2019.12.03|Silicon Angle| → [[With S3 Access Points, Amazon aims to make it easy to manage shared data|https://siliconangle.com/2019/12/03/amazon-makes-easy-manage-shared-data-s3-access-points/]]|AWS S3|
|2019.12.05|SecurityWeek| → [[AWS Unveils New Security Services and Capabilities|https://www.securityweek.com/aws-unveils-new-security-services-and-capabilities]]|AWS|
|2019.12.03|//Compare the Cloud//|[[Multi-cloud, Fog, Edge & Hybrid Computing – What's the Difference?|https://www.comparethecloud.net/articles/multi-cloud-fog-edge-hybrid-computing-whats-the-difference/]]|Multi_Cloud|
|2019.12.03|//Tuffin//|[[How to migrate apps and workloads to the cloud securely and efficiently|https://www.tufin.com/blog/cloud-migration-apps-workloads]]|Migration|
|2019.12.03|//Park my Cloud//|[[Cloud Control: Why Is It So Hard?|https://www.parkmycloud.com/blog/drivers-to-cloud/]]|Controls|
|>|>|>|!2019.12.02|
|2019.12.02|ENISA|![[Cybersecurity certification: lifting the EU into the cloud|https://www.enisa.europa.eu/news/enisa-news/cybersecurity-certification-lifting-the-eu-into-the-cloud]]|Certification|
|2019.12.02|ENISA| → [[CSPCERT WG - Recommendations for the implementation of the CSP Certification scheme|https://drive.google.com/file/d/1J2NJt-mk2iF_ewhPNnhTywpo0zOVcY8J/view]]|Certification|
|2019.12.02|Bleeping Computer|[[Office 365 To Get Microsoft Recommended Security Profiles|https://www.bleepingcomputer.com/news/security/office-365-to-get-microsoft-recommended-security-profiles/]]|O365|
|2019.12.02|Center for Internet Security|[[CIS Debuts New Benchmarks, Hardened Images at AWS re:Invent|https://www.cisecurity.org/press-release/cis-debuts-new-benchmarks-hardened-images-at-aws-reinvent/]]|Hardening|
|2019.12.02|//AWS//|![[Monitor, review, and protect Amazon S3 buckets using Access Analyzer for S3|https://aws.amazon.com/blogs/storage/protect-amazon-s3-buckets-using-access-analyzer-for-s3/]]|AWS S3 Monitoring|
|2019.12.02|//AWS//| → [[Introducing Access Analyzer for Amazon S3 to review access policies|https://aws.amazon.com/about-aws/whats-new/2019/12/introducing-access-analyzer-for-amazon-s3-to-review-access-policies/]]|AWS S3 Monitoring|
|2019.12.03|HelpNet Security| → [[Control access and permissions to AWS services and resources|https://www.helpnetsecurity.com/2019/12/03/aws-iam-access-analyzer/]]|AWS S3 Monitoring|
|2019.12.03|The Register| → [[AWS has new tool for those leaky S3 buckets so, yeah, you might need to reconfigure a few things|https://www.theregister.co.uk/2019/12/03/aws_s3_buckets/]]|AWS S3 Monitoring|
|2019.12.03|CloudPro| → [[AWS plugs leaky S3 buckets with CloudKnox integration|https://www.cloudpro.co.uk/it-infrastructure/security/8327/aws-plugs-leaky-s3-buckets-with-cloudknox-integration]]|AWS S3 Monitoring|
|2019.12.07|//BitDefender//| → [[Amazon Battles Leaky S3 Buckets with a New Security Tool|https://businessinsights.bitdefender.com/amazon-battles-leaky-s3-buckets-with-a-new-security-tool]]|AWS Tools|
|2019.12.02|//Security Intelligence//|[[Attain Embedded Cloud Security With a DevSecOps Approach|https://securityintelligence.com/posts/attain-embedded-cloud-security-with-a-devsecops-approach/]]|DevSecOps|
|2019.12.02|//CyberArk//|[[BlackDirect: Microsoft Azure Account Takeover|https://www.cyberark.com/threat-research-blog/blackdirect-microsoft-azure-account-takeover/]]|Azure OAuth|
|2019.12.02|//CyberArk//| → Site Web [[BlackDirect|https://black.direct/]]|Azure OAuth|
|2019.12.02|//Threatpost//| → [[Microsoft OAuth Flaw Opens Azure Accounts to Takeover|https://threatpost.com/microsoft-oauth-flaw-azure-takeover/150737/]]|Azure OAuth|
|2019.12.05|CISO Mag| → [[Security Flaw in Microsoft Azure Lets Hackers Control Azure Accounts|https://www.cisomag.com/security-flaw-in-microsoft-azure-lets-hackers-control-azure-accounts/]]|Azure OAuth|
|2019.12.02|//McAfee//|[[Data in the Cloud is Much More at Risk Than Enterprises May Think|https://www.cisomag.com/a-secure-bridge-to-the-cloud/]]|Risks|
|2019.12.02|//Cloudflare//|[[The Serverlist: Full Stack Serverless, Serverless Architecture Reference Guides, and more|https://blog.cloudflare.com/serverlist-10th-edition/]]|Serverless|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Décembre 2019]]>>
[>img(200px,auto)[iCSF/DKCFCS.png]]L'agence nationale de sécurité danoise, "Center for Cybersikkerhed", et le Conseil national de la numérisation ont publié un guide intitulé "//Vejledning til anvendelse af Cloudservices//" ou "Nouvelle orientation sur le Cloud pour les agences gouvernementales", avec un ensemble de directives.
!Contexte
[>img(80px,auto)[iCSF/DK.png]]Le document intègre des considérations commerciales, juridiques et de sécurité que les autorités devraient prendre en compte lors de l'utilisation de services Cloud.
Son but est de fournir un cadre d'utilisation et un processus de prise de décision pour savoir si les services Cloud peuvent être utilisés ou non. 
Il passe donc en revue ce qu'est le Cloud, et les problèmes juridiques clés, explique comment aborder la sécurité des informations lors du transfert d'une application vers le Cloud, donne les moyens de d'évaluer les opportunités et les responsabilités liées à l'utilisation du Cloud.
Les 4 parties principales du document sont ainsi :
* Introduction aux services Cloud : les concepts de base, les modèles, leurs avantages et inconvénients
* Aspects commerciaux : besoins de l'entreprise en matière de vices Cloud, et ce que cela implique pour l'organisation.
* Aspects juridiques : sécurité des données, notamment lors du traitement de données à caractère personnel
* Aspects sécurité de l'information : exigences sécurité spécifiques apportés par les services Cloud
!Principaux éléments du guide
* Nécessité de clarifier les exigences de l'entité qui a le besoin et les implications organisationnelles des opérations et du développement basés sur le Cloud
* Évaluer les risques techniques, de sécurité, financiers, procéduraux, d'organisation et de compétence.
** Veiller à ce que les mesures de sécurité soient reflétées dans les exigences de la solution Cloud
** Permettre un contrôle adapté de la conformité du fournisseur aux exigences convenues et acceptées
** Prendre en compte les futures exigences
* Si des données à caractère personnel sont en jeu, prendre en compte certaines considérations particulières résultant du RGPD.
** L'évaluation des risques doit porter sur les risques liés au traitement de données à caractère personnel
** Mener une analyse d'impact si le niveau de risque pour les droits des personnes concernées est élevé
** Intégrer si nécessaire les aspects de localisation des données, avec éventuellement la localisation au Danemark
** Conclure un contrat de traitement de données, incluant notamment des conditions ou instructions de supervision, de déclaration d'assurance, de transfert dans des pays tiers, de localisation du traitement, ainsi que le retour et la suppression des données à la fin du contrat
** Utiliser, par exemple, la norme ISO 27701 qui permet de cartographier les liens entre les dispositions du RGD et la sécurité de l'information. Le cas échéant, s'appuyer sur les normes ISO 27001, 27002, 27017 et 27018.
Enfin, le guide rappelle aussi qu'il appartient à l'entité concernée de veiller à ce que les objectifs de sécurité soient atteints.
Même s'il est principalemnt destiné aux institutions publiques et gouvernementales, ce guide peut également s'appliqué dans le privé.
!Plan du guide
Le guide comporte 46 pages :[>img(200px,auto)[iCSF/JBTDK.png]]
|!1|>|!Introduction|
|!2|>|!Introduction aux services Cloud|
|!3|>|!Aspects commerciaux|
| |3.1|Besoins d'organisation et de compétences|
|~|3.2|Agilité et innovation|
|~|3.3|Dimensionnement|
|~|3.4|Dépendance au fournisseur|
|~|3.5|Gestion financière|
|!4|>|!Aspects juridiques|
| |4.1|Conditions spéciales pour le traitement des données personnelles|
|~|4.2|Contrats de traitement de données|
|~|4.3|Transferts en provenance de pays tiers|
|~|4.4|Évaluation d'impact|
|~|4.5|La condition de localisation requise par la loi sur la protection des données|
|~|4.6|Protection des données par la conception et par défaut|
|~|4.7|Autre législation|
|!5|>|!Aspects sécurité|
| |5.1|Évaluation des risques de la solution Cloud|
|~|5.2|Sécurité de traitement|
|~|5.3|Sécurité et nécessité de clarification|
|~|5.4|Sécurité des achats|
|~|5.5|Sécurité pendant le fonctionnement|
|~|5.6|Résiliation ou modification de la relation fournisseur|
|~|5.7|Gestion des mises à jour|
|~|5.8|Formation|
|~|5.9|Test et développement|
|!6|>|!Synthèse|
!Liens
* Annonce :  → ''[[CloudSecurityAlliance.fr/go/jc7a/|https://cloudsecurityalliance.fr/go/jc7a/]]'' 
* Document (en danois, format PDF) :  → ''[[CloudSecurityAlliance.fr/go/jc7p/|https://cloudsecurityalliance.fr/go/jc7p/]]'' 
[img[iCSF/flag_fr.png]][img(50%,1px)[iCSF/BluePixel.gif]]
!"//Cloud Security Alliance Announces Industry's First Credential for Cloud Auditing//"
<<<
[>img(200px,auto)[iCSA/CCAK.png]]//The Certificate of Cloud Auditing Knowledge ([[CCAK]]) allows professionals to demonstrate expertise in auditing cloud computing systems
Las Vegas - Dec. 4, 2019. The [[Cloud Security Alliance]] ([[CSA]]), the world's leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today announced the Certificate of Cloud Auditing Knowledge ([[CCAK]]), the only credential for industry professionals that demonstrates expertise in the essential principles of auditing cloud computing systems. Set to be released in the second half of 2020, the [[CCAK]] aims to solve the current industry knowledge gap for IT audit and security professionals trained and certified for traditional on-premise IT auditing and assurance.

Designed to provide CISOs, security and compliance managers, internal and external auditors, and practitioners of tomorrow with the proven skillset to address the specific concerns that arise from the use of various forms of cloud services, the [[CCAK]] will provide a common baseline of expertise and shared nomenclature to ensure that IT auditors and other related stakeholders are communicating appropriately and accurately regarding the effectiveness of cloud security controls.

With its focus on cloud computing, the [[CCAK]] differs from traditional IT audit certification programs, which have many excellent elements, but were not developed with an understanding of cloud computing and its many nuances. An audited organization using cloud computing, for instance, will have a very different approach to satisfying control objectives, and a cloud tenant will certainly not have the same administrative access as in a legacy IT system and will employ a wide range of security controls that will be foreign to an audit and assurance professional grounded in traditional IT audit practices.

"Cloud computing represents a radical departure from legacy IT in virtually every respect. The new technology architecture, the nature of how cloud is provisioned, and the new shared responsibility model means that IT audits must be significantly altered to provide assurance to stakeholders that their cloud adoption is secure," said Jim Reavis, co-founder and CEO, ''Cloud Security Alliance''. "Because CSA already has developed the most widely adopted cloud security audit criteria and organizational certification, we are uniquely positioned to lead efforts to ensure industry professionals have the requisite skill set for auditing cloud environments."

The [[CCAK]]'s holistic body of knowledge will be composed of the ''CSA'''s ''Cloud Controls Matrix'' ([[CCM]]), the fundamental framework of cloud control objectives; its companion ''Consensus Assessments Initiative Questionnaire'' ([[CAIQ]]), the primary means for assessing a cloud provider's adherence to ''CCM''; and the ''Security, Trust, Assurance & Risk'' ([[STAR]]) program, the global leader in cloud security audits and self-assessments, in addition to new material.

For more than 10 years, ''CSA'' has led the development of the trusted cloud ecosystem, which notably includes the ''STAR'' program and the Certificate of Cloud Security Knowledge ([[CCSK]]), the gold standard for measuring professional competency in cloud security. The [[CCAK]] and the [[CCSK]] will complement one another in that the [[CCSK]] provides the knowledge that enables an expert to secure cloud systems that will, in turn, be successfully scrutinized by an expert holding the [[CCAK]]. In many cases, an industry professional will be well served by obtaining both certificates.

Because the [[CCAK]] is intended to create a common cloud audit understanding, it's expected to become a mandatory requirement for IT auditors and highly recommended for IT managers and professionals, especially governance, risk management, compliance, and vendor/supply chain management.//
<<<
__Liens :__
* Annonce :  → ''[[CloudSecurityAlliance.fr/go/jc4a/|https://cloudsecurityalliance.fr/go/jc4a/]]''
* Page dédiée au CCAK → ''[[CloudSecurityAlliance.fr/go/CCAK/|https://cloudsecurityalliance.fr/go/CCAK/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!1 - Les nouveautés CSA de la semaine du 25 novembre au 1^^er^^ décembre 2019 [>img[iCSF/cloud-security-alliance-fr.png]]
* Actu : Appel à commentaires, document "''Cloud Incident Response Framework – A Quick Guide''" +++*[»]> <<tiddler [[2019.11.28 - Actu : Appel à commentaires, document 'Cloud Incident Response Framework – A Quick Guide']]>>=== 
* Actu : Appel à commentaires, document "''Hybrid Cloud and Its Associated Risks''" +++*[»]> <<tiddler [[2019.11.28 - Actu : Appel à commentaires, document 'Hybrid Cloud and Its Associated Risks']]>>=== 
* Blog : 'Qu'est-ce que la Pseudo Crypto-Monnaie' +++*[»]> <<tiddler [[2019.11.25 - Blog : Qu'est-ce que la Pseudo Crypto-Monnaie]]>>=== 
* Actu : Derniers jours pour ''valider la traduction en français de 3 documents CSA'' (CCM, CAIQ et PLA CoC) +++*[»]> <<tiddler [[2019.11.13 - Actu : Demande de validation de la traduction en français de 3 documents CSA]]>>=== 
!2 - Veille Web
La +++*[Veille Web]> <<tiddler [[2019.12.01 - Veille Hebdomadaire]]>>=== avec plus de 30 liens
* Bonnes pratiques et recommendations : Docker, Kubernetes
* Rapport : ''CIGREF'' sur la régulation du marché européen du Cloud +++*[»]> 
|2019.11.18|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Services Cloud : Microsoft veut appliquer la conformité au RGPD partout|https://www.silicon.fr/services-cloud-microsoft-veut-appliquer-la-conformite-rgpd-partout-326317.html]]|Microsoft GDPR|
|2019.11.18|//Microsoft//| → [[Introducing more privacy transparency for our commercial cloud customers|https://blogs.microsoft.com/eupolicy/2019/11/18/introducing-privacy-transparency-commercial-cloud-customers/|https://blogs.microsoft.com/eupolicy/2019/11/18/introducing-privacy-transparency-commercial-cloud-customers/]]|Microsoft GDPR|
|2019.11.18|The Register| → [[You're about to gouda major change in Microsoft cloud security after Redmond agrees to go Dutch on data|https://www.theregister.co.uk/2019/11/18/microsoft_gdpr_moj_deal/]]|Microsoft GDPR|
|2019.11.18|CBR Online| → [[Microsoft Buckles Under EU Pressure: Changes Cloud Contracts to Reflect "Data Controller" Role|https://www.cbronline.com/news/microsoft-cloud-terms]]|Microsoft GDPR|
|2019.11.19|Le Monde Informatique[>img[iCSF/flag_fr.png]]| → [[Microsoft révise ses contrats de services cloud pour l'Union européenne|https://www.lemondeinformatique.fr/actualites/lire-microsoft-revise-ses-contrats-de-services-cloud-pour-l-union-europeenne-77118.html]]|Microsoft GDPR|
=== 
* Divers : Cloud et résilience, Cloud et PRA, évaluation des prestataires Cloud
!3 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Novembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.12.01|
|2019.12.01|KitPloit|[[CCAT - Cloud Container Attack Tool For Testing Security Of Container Environments|https://www.kitploit.com/2019/12/ccat-cloud-container-attack-tool-for.html]]|Tools Containers|
|2019.12.01|//Tripwire//|[[Security for Cloud Services: IaaS Deep Dive|https://www.tripwire.com/state-of-security/security-data-protection/cloud/security-cloud-services-iaas-deep-dive/]] (3/3)|IaaS|
|>|>|>|!2019.11.29|
|2019.11.29|Center for Cybersikkerhed|![[Nouvelle directive sur le cloud pour les autorités publiques|https://fe-ddis.dk/cfcs/nyheder/arkiv/2019/Pages/cloudvejledning-for-offentlige-myndigheder.aspx]]|Guidelines Denmark|
|2019.11.29|Container Journal|[[Sysdig's Third Annual Container Usage Report Reveals That Container Lifespan Has Been Cut in Half |https://containerjournal.com/news/news-releases/sysdigs-third-annual-container-usage-report-reveals-that-container-lifespan-has-been-cut-in-half/]]|Containers Survey|
|2019.11.29|//Fortinet//|[[Four ways to develop a hybrid cloud security strategy|https://www.itworldcanada.com/sponsored/four-ways-to-develop-a-hybrid-cloud-security-strategy]]|Hybrid_Cloud|
|2019.11.29|//Sunguard//|![[Embedding resilience into your cloud-based modernisation strategy|https://www.continuitycentral.com/index.php/news/resilience-news/4674-embedding-resilience-into-your-cloud-based-modernisation-strategy]]|Resilience|
|>|>|>|!2019.11.28|
|2019.11.28|//DivvyCloud//|[[Forecasting the cloud security landscape in 2020|https://betanews.com/2019/11/28/forecasting-cloud-security-2020/]]|Predictions|
|2019.11.28|//Cloudonaut//|[[Checklist: Is your application ready for a container cluster?|https://cloudonaut.io/checklist-container-cluster-ecs-fargate/]]|Containers|
|>|>|>|!2019.11.27|
|2019.11.27|Journal du Net[>img[iCSF/flag_fr.png]]|[[Etat des lieux du cloud dans le secteur de la santé|https://www.journaldunet.com/solutions/expert/72165/etat-des-lieux-du-cloud-dans-le-secteur-de-la-sante.shtml]]|Healthcare|
|2019.11.27|ZDnet|[[Predictions 2020: Cloud computing sees new alliances and new security concerns|https://news.hitb.org/content/predictions-2020-cloud-computing-sees-new-alliances-and-new-security-concerns]]|Predictions|
|2019.11.27|Container Journal|[[Securing Docker Containers: A Primer|https://containerjournal.com/topics/container-security/securing-docker-containers-a-primer/]]|Docker|
|2019.11.27|//Compare the Cloud//|[[A brief history of disaster recovery|https://www.comparethecloud.net/articles/a-brief-history-of-disaster-recovery/]] ([[vidéo|https://www.youtube.com/watch?v=BJ2g_1-m_mo]])|DRP DRaaS|
|2019.11.27|//Google//|[[Exploring container security: Day one Kubernetes decisions|https://cloud.google.com/blog/products/containers-kubernetes/security-considerations-for-google-kubernetes-engine]]|Kubernetes Best_Practices|
|2019.11.27|//Alcide//|[[Prevent Costly Mistakes that Expose Your Kubernetes Service|https://blog.alcide.io/prevent-costly-mistakes-that-expose-your-kubernetes-service]]|Kubernetes Best_Practices|
|2019.11.27|//Tresorit//|[[Choosing the Right Cloud Provider: The Importance of Security Assessments|https://www.infosecurity-magazine.com/blogs/choosing-the-right-cloud-provider/]]|Vendors Assessment|
|>|>|>|!2019.11.26|
|2019.11.26|Solutions Numériques[>img[iCSF/flag_fr.png]]|[[Sécurité d'Office 365 : les entreprises doivent agir|https://www.solutions-numeriques.com/dossiers/securite-doffice-365-les-entreprises-doivent-agir/]]|O365|
|2019.11.26|Alain Bensoussan[>img[iCSF/flag_fr.png]]|[[Les contrats cloud Microsoft rattrapés par le RGPD|https://www.alain-bensoussan.com/avocats/les-contrats-cloud-microsoft-rattrapes-par-le-rgpd/2019/11/26/]]|Microsoft RGPD|
|2019.11.26|ZDnet|[[A hacking group is hijacking Docker systems with exposed API endpoints|https://www.zdnet.com/article/a-hacking-group-is-hijacking-docker-systems-with-exposed-api-endpoints/]]|Attacks Docker|
|2019.11.26|Silicon Angle|[[Vulnerable Docker instances targeted in cryptocurrency mining campaign|https://siliconangle.com/2019/11/27/vulnerable-docker-instances-targeted-cryptocurrency-mining-campaign/]]|Attacks Docker|
|2019.11.26|Silicon Angle|[[Designing security for an open-source, containerized, cloud-native world|https://siliconangle.com/2019/11/26/designing-security-for-an-open-source-containerized-cloud-native-world-kubecon/]] ([[vidéo|http://www.youtube.com/watch?v=i4Xo_OYSShk]])|Cloud_Native Containers|
|>|>|>|!2019.11.25|
|2019.11.25|LeMagIT[>img[iCSF/flag_fr.png]]|[[Sécurité du cloud : dix ans après le lancement de la CSA, les chantiers restent énormes|https://www.lemagit.fr/actualites/252474540/Securite-du-Cloud-dix-ans-apres-le-lancement-de-la-CSA-les-chantiers-restent-enormes]]|CSA trends|
|2019.11.25|CIGREF[>img[iCSF/flag_fr.png]]|![[SWIPO : Échec de la régulation du marché européen du cloud|https://www.cigref.fr/swipo-echec-regulation-marche-europeen-cloud]] ([[pdf|https://www.cigref.fr/wp/wp-content/uploads/2019/11/CP-SWIPO-Cigref-version-francaise-2019-11-25.pdf]])|Regulations SWIPO|
|2019.11.25|LeMagIT[>img[iCSF/flag_fr.png]]| → [[Pour le Cigref, la première tentative d'autorégulation du cloud en Europe est un "échec"|https://www.lemagit.fr/actualites/252474525/Pour-le-CIGREF-la-premiere-tentative-dautoregulation-du-cloud-en-Europe-est-un-echec]]|Regulations SWIPO|
|2019.11.26|Silicon.fr[>img[iCSF/flag_fr.png]]| → [[Cloud : le Cigref adoube les contrats IaaS mais critique le SaaS|https://www.silicon.fr/cloud-europeen-cigref-critique-saas-327207.html]]|Regulations SWIPO|
|2019.11.25|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Multicloud : la sécurité est le principal défi à relever|https://www.silicon.fr/multicloud-securite-principal-defi-327095.html]]|Misc|
|2019.11.25|Solutions Review|[[Google Announces New Security Capabilities for Google Cloud|https://solutionsreview.com/cloud-platforms/google-announces-new-security-capabilities-for-google-cloud/]]|GCP|
|2019.11.25|CBR On Line|[[An Idiot's Guide to Kubernetes|https://www.cbronline.com/feature/an-idiots-guide-to-kubernetes]]|Kubernetes|
|2019.11.25|Techradar Pro|[[Amazon files official JEDI contract complaint|https://www.techradar.com/news/amazon-files-official-jedi-contract-complaint]]|JEDI|
|2019.11.25|eWeek|[[Recognizing the Right Stuff in Cloud Security|https://www.eweek.com/cloud/recognizing-the-right-stuff-in-cloud-security]]|Misc|
|2019.11.25|//Cisco//|[[Security's New Address: The Cloud|https://umbrella.cisco.com/blog/2019/11/25/securitys-new-address-the-cloud/]]|Gartner Network|
|2019.11.25|//Compare the Cloud//|[[Cloud Vendor Assessments - Done The Right Way|https://www.comparethecloud.net/articles/cloud-vendor-assessments-done-right/]]|Vendors Assessment|
|2019.11.25|//Heimdal//|[[What is the Zero Trust Model?|https://heimdalsecurity.com/blog/what-is-the-zero-trust-model/]]|Zero_Trust|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Novembre/Décembre 2019]]>>
!"//The Four Pillars of CASB: Visibility//"
[>img(100px,auto)[iCSA/JC4BT.jpg]]^^Article publié le 4 décembre sur le blog de la CSA, et après l'avoir été il y a plus de 6 semaines sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://cloudsecurityalliance.org/articles/the-four-pillars-of-casb-visibility/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.bitglass.com/blog/four-pillars-casb-visibility]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201911>>
<<tiddler fAll2Tabs10 with: VeilleM","_201911>>
|!Novembre|!Sources|!Titres et Liens|!Keywords|
|2019.11.19|//PaloAlto Networks//|![[Docker Patched the Most Severe Copy Vulnerability to Date With CVE-2019-14271|https://unit42.paloaltonetworks.com/docker-patched-the-most-severe-copy-vulnerability-to-date-with-cve-2019-14271/]]|Docker CVE-2019-14271|
|2019.07.25|MITRE|[[CVE-2019-14271|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14271]]|Docker CVE-2019-14271|
|2019.11.19|GBHackers on Security| → [[Most Critical Docker Vulnerability Let Hackers To Take Complete Control Over Host & All Containers Within It|https://gbhackers.com/docker-vulnerability/]]|Docker CVE-2019-14271|
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Novembre 2019]]>>
<<tiddler fAll2LiTabs with: NewsL","201911>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Novembre 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Novembre 2019]]>><<tiddler fAll2LiTabs with: Actu","201911>>
<<tiddler fAll2LiTabs with: Blog","201911>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Novembre 2019]]>>
<<tiddler fAll2LiTabs with: Publ","201911>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Novembre 2019]]>>
Un appel à commentaires dont la date de clôture est le ''27 décembre 2019'' : "''Cloud Incident Response Framework – A Quick Guide''".
<<<
//What this Quick Guide aims to do is to distill and give readers an overview of key contributions of the work currently undertaken in the CIR WG, towards a comprehensive CIR framework. The CIR WG hopes to take this opportunity to encourage volunteers to participate in the WG's efforts and provide valuable feedback to the ongoing work.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/jbsi/|https://cloudsecurityalliance.fr/go/jbsi/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
Un appel à commentaires dont la date de clôture est le ''27 décembre 2019'' : "''Hybrid Cloud and Its Associated Risks''".
<<<
//Cloud computing is flourishing. Hybrid clouds, especially, have been gaining more traction as cloud customers increasingly understand that using public clouds or private clouds alone poses certain limitations. Hybrid cloud is often the starting point for organizations to get started on the cloud journey and this document aims to describe the concept and value of hybrid clouds, highlight key application scenarios and point out security risks in the hybrid cloud.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/jbsh/|https://cloudsecurityalliance.fr/go/jbsh/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//What's a Pseudo Cryptocurrency?//"
[>img(150px,auto)[iCSA/JBLBD.jpg]]Article de blog publié le 25 novembre 2019 — Rédigé par Kurt Seifried, Chief Blockchain Officer, CSA
<<<
//You may not have yet seen the term "pseudo cryptocurrency," in fact it (as of 2019-08-22) it only shows up 2030 Google search results and a quarter million without the quotes. So if nobody is using this term, why does it matter?
Currently, we have a number of established cryptocurrencies such as Bitcoin, Ethereum, Litecoin, Zcash, Mondero and so on. They tend to share two major characteristics:
* They are decentralized, meaning no single central authority controls them entirely
* Secondly, they can be used to represent value, with varying degrees of stability, or in the case of Bitcoin: buckle up!
The term pseudo cryptocurrency is not completely established yet but appears to be in use for two main reasons. You want to talk about a cryptocurrency that isn't decentralized enough and is part of a scammy initial coin offering. Or you want to talk about something that has many of the properties of the established cryptocurrencies but isn't a currency.

The first case isn't too interesting, there are many new cryptocurrency projects that are not decentralized or "pure" enough, and to be clear there is a place for these.
The second case is much more interesting, like most new technologies we started with a single ambitious use case ("replace all the banks! 2EZ!") that has morphed and grown to other use cases (e.g. inventory tracking and food safety) and we're even starting to see hybrid projects. Measuring and tracking value is a core activity for many businesses and projects. Still, you probably don't want to actually be a currency as this means you'll have to deal with the SEC (in America) or their local counterpart, and if you're really unlucky, you may end up in front of a Senate hearing getting grilled on just what exactly it is you're planning to do.

Many systems that store and distribute information (privately and publicly) can also allow you to conduct transactions with it. For example, a résumé or CV cannot be spent to buy a candy bar, but a good résumé or CV can definitely help you get a better job so you can buy more candy bars. You can't "spend" your résumé, but you can increase the value inherent in your résumé through training, experience, certifications and so on that can then be used to get a pay raise or a better job. Measuring that value is where the pseudo cryptocurrency comes in. Allowing the market to abstract the value into a standard form makes it much easier to examine and compare résumés. For people using the system, they can listen to what the market values and get certifications that actually provide them with more value.
You can read more about Blockchain in CSA's uses cases research report +++*[here]> <<tiddler [[2018.11.27 - Publication : Blockchain DLT Use Cases]]>> ===. Interested in reading more about Blockchain from the Seifried Files?//[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jbpb/]] sur le blog de la CSA.
!1 - Les nouveautés CSA de la semaine du 18 au 24 novembre 2019
* Publication : 4 documents CSA sur le ''RGPD'' +++*[»]> <<tiddler [[2019.11.19 - Publication : 4 documents CSA sur le RGPD]]>>=== [>img[iCSF/cloud-security-alliance-fr.png]]
* Publication : Présentations au Forum CSA 2019 du Colorado +++*[»]> <<tiddler [[2019.11.18 - Publication : Présentations au Forum CSA 2019 du Colorado]]>>=== 
* Actu : Nouvelle ''demande de validation de la traduction en français de 3 documents CSA'' (CCM, CAIQ et PLA CoC) +++*[»]> <<tiddler [[2019.11.13 - Actu : Demande de validation de la traduction en français de 3 documents CSA]]>>=== 
* Actu : CCSK Plus Labs pour plate-forme Microsoft Azure +++*[»]> <<tiddler [[2019.11.20 - Actu : CCSK Plus Labs pour plate-forme Microsoft Azure]]>>=== 
!2 - Veille Web
La +++*[Veille Web]> <<tiddler [[2019.11.24 - Veille Hebdomadaire]]>>=== avec plus de 40 liens
* Alerte : analyse de la vulnérabilité ''Docker CVE-2019-14271''
* Incidents et pannes : plusieurs pannes Azure en Australie
* Outils : Benchmarking CIS pour AWS, Azure et GCP
* Divers : répertoire de liens sur Dockers, Chaos Engineering pour Kubernetes
* Rapport : Information Security Forum+++*[»]>
|2019.11.19|Information Security Forum|[[ISF Releases Using Cloud Services Securely: Harnessing Core Controls|https://vmblog.com/archive/2019/11/19/isf-releases-using-cloud-services-securely-harnessing-core-controls.aspx]]|Best_Practices Controls|
|2019.11.19|Information Security Forum| → [[Using Cloud Services Securely: Harnessing Core Controls|https://www.securityforum.org/research/using-cloud-services-securely-harnessing-core-controls/]] ([[synthèse|https://www.securityforum.org/uploads/2019/11/ISF_Using-Cloud-Services-Securely_Executive-Summary-PWS-new.pdf]])|Best_Practices Controls|
===, TrendMicro
!3 - Conférences et Salons
* Le ''Cloud & Cyber Security Expo c'est cette semaine'' : ''mercredi 27 et jeudi 28 novembre'' à Paris, Porte de Versailles
** ''Troisième'' teaser et inscription gratuite +++*[»]> <<tiddler [[2019.11.22 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (3/3)]]>>=== 
** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Novembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.11.26|
|2019.11.26|Informatique News[>img[iCSF/flag_fr.png]]|[[Google abandonne Cloud Print|https://www.informatiquenews.fr/google-abandonne-cloud-print-65041]]|GCP|
|2019.11.26|InfoSecurity Mag|[[DevOps, Cloud and Remote Workers Dominate 2020 Risks|https://www.infosecurity-magazine.com/news/devops-cloud-remote-workers/]]|Trends Risks|
|>|>|>|!2019.11.24|
|2019.11.24|//Tripwire//|[[Cloud Security Threats: Escaping the Egregious Eleven - Part Two|https://www.tripwire.com/state-of-security/featured/cloud-security-threats-escaping-egregious-eleven-part-two/]] (2/2)|CSA Threats|
|2019.11.24|//Tripwire//|[[Security for Cloud Services: PaaS Deep Dive|https://www.tripwire.com/state-of-security/security-data-protection/cloud/security-cloud-services-paas-deep-dive/]] (2/3)|PaaS|
|>|>|>|!2019.11.22|
|2019.11.22|Wired|[[1.2 Billion Records Found Exposed Online in a Single Server|https://www.wired.com/story/billion-records-exposed-online/]]|Data_Leak|
|2019.11.22|Data Viper| → [[Personal and Social information of 1.2 billion people Discovered in Massive Data Leak|https://www.dataviper.io/blog/2019/pdl-data-exposure-billion-people/]]|Data_Leak|
|2019.11.22|CRN|[[Australia cops third Microsoft cloud outage in a week|https://www.crn.com.au/news/australia-cops-third-microsoft-cloud-outage-in-a-week-534452]]|Azure Outage Australia|
|2019.11.22|//Blissfully//|[[What HR Needs to Know About SaaS Security|https://www.blissfully.com/blog/what-hr-needs-to-know-about-saas-security/]]|SaaS|
|>|>|>|!2019.11.21|
|2019.11.21|Bleeping Computer|[[Microsoft 365 Experiencing OneDrive and SharePoint Outages|https://www.bleepingcomputer.com/news/microsoft/microsoft-365-experiencing-onedrive-and-sharepoint-outages/]]|O365 OneDrive Sharepoint Outage|
|2019.11.21|ComputerWeekly|[[Security Think Tank: Stopping data leaks in the cloud|https://www.computerweekly.com/opinion/Security-Think-Tank-Stopping-data-leaks-in-the-cloud]]|DataLeaks|
|2019.11.21|Federal News Network|[[Goodrich overcame naysayers, doubters to advance cloud security|https://federalnewsnetwork.com/ask-the-cio/2019/11/goodrich-overcame-naysayers-doubters-to-advance-cloud-security/]]|Misc|
|2019.11.21|//Security Intelligence//|[[5 Cloud Security Considerations to Ensure a Successful Migration|https://securityintelligence.com/posts/5-cloud-security-considerations-to-ensure-a-successful-migration/]]|Migration|
|2019.11.21|//FireEye//|[[The Cloud Revolution and the Future of the SOC|https://www.fireeye.com/blog/products-and-services/2019/11/cloud-revolution-and-the-future-of-the-soc.html]] ([[podcast|https://www.hipcast.com/podcast/HqmqyRZs]] [[mp3|https://fireeyeinc.hipcast.com/download/fireeyeinc-20191119120146-2659.mp3]])|SOC|
|2019.11.21|//Caylent//|[[Top Secrets Management Tools Compared|https://caylent.com/top-secrets-management-tools-compared]]|Secret_Management|
|>|>|>|!2019.11.20|
|2019.11.20|Forbes|[[The Kubernetes Ship Has Set Sail: Is Your Security Team On Board?|https://www.forbes.com/sites/forbestechcouncil/2019/11/20/the-kubernetes-ship-has-set-sail-is-your-security-team-on-board/]]|Kubernetes|
|2019.11.20|Infosec|[[Malware overview - Graboid|https://resources.infosecinstitute.com/malware-overview-graboid/]]|Graboid|
|2019.11.20|The Register|[[Cloud nine to cloud nein: Google beefs up punters' data encryption to fend off cyber-thieves|https://www.theregister.co.uk/2019/11/20/google_cloud_next/]]|GCP|
|2019.11.21|CRN| → [[Google Cloud unveils new security capabilities|https://www.crn.com.au/news/google-cloud-unveils-new-security-capabilities-534305]]|GCP|
|2019.11.20|David Balut|[[Useful training and mindset for becoming a Cloud Security Architect|https://dawidbalut.com/2019/11/20/useful-training-and-mindset-for-becoming-a-cloud-security-architect/]]|Training|
|2019.11.20|CRN|[[Microsoft blames networking build for 365 outage|https://www.crn.com.au/news/microsoft-blames-networking-build-for-365-outage-534278]]|Azure Outage Australia|
|2019.11.20|//Security Intelligence//|[[Reimagining Security for a Multicloud World|https://securityintelligence.com/posts/reimagining-security-for-a-multicloud-world/]]|Multi_Cloud|
|2019.11.20|//Checkpoint//|[[6 DevSecOps Sessions You Won't Want to Miss at AWS Re:Invent|https://blog.checkpoint.com/2019/11/20/6-devsecops-sessions-you-wont-want-to-miss-at-aws-reinvent/]]|DevSecOps|
|2019.11.20|//Google//|[[Advancing control and visibility in the cloud|https://cloud.google.com/blog/products/identity-security/new-security-tools-for-google-cloud-and-g-suite]]|GCP|
|>|>|>|!2019.11.19|
|2019.11.19|Information Security Forum|[[ISF Releases Using Cloud Services Securely: Harnessing Core Controls|https://vmblog.com/archive/2019/11/19/isf-releases-using-cloud-services-securely-harnessing-core-controls.aspx]]|Best_Practices Controls|
|2019.11.19|Information Security Forum| → [[Using Cloud Services Securely: Harnessing Core Controls|https://www.securityforum.org/research/using-cloud-services-securely-harnessing-core-controls/]] ([[synthèse|https://www.securityforum.org/uploads/2019/11/ISF_Using-Cloud-Services-Securely_Executive-Summary-PWS-new.pdf]])|Best_Practices Controls|
|2019.11.19|//PaloAlto Networks//|![[Docker Patched the Most Severe Copy Vulnerability to Date With CVE-2019-14271|https://unit42.paloaltonetworks.com/docker-patched-the-most-severe-copy-vulnerability-to-date-with-cve-2019-14271/]]|Docker CVE-2019-14271|
|2019.07.25|MITRE|[[CVE-2019-14271|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14271]]|Docker CVE-2019-14271|
|2019.11.19|GBHackers on Security| → [[Most Critical Docker Vulnerability Let Hackers To Take Complete Control Over Host & All Containers Within It|https://gbhackers.com/docker-vulnerability/]]|Docker CVE-2019-14271|
|2019.11.19|CRN|[[Microsoft 365 outage strikes, lasts about four hours|https://www.crn.com.au/news/microsoft-365-outage-strikes-534267]]|Azure Outage Australia|
|2019.11.19|ZDnet|[[Nextcry : un ransomware s'attaque aux instances NextCloud|https://www.zdnet.fr/actualites/nextcry-un-ransomware-s-attaque-aux-instances-nextcloud-39894109.htm]]|NextCloud Ransomware|
|2019.11.19|//TrendMicro//|[[The New Norm - Trend Micro Security Predictions For 2020|https://www.trendmicro.com/vinfo/fr/security/research-and-analysis/predictions/2020]] ([[rapport (pdf)|https://documents.trendmicro.com/assets/rpt/rpt-the-new-norm-trend-micro-security-predictions-for-2020.pdf]]|Trends Report|
|>|>|>|!2019.11.18|
|2019.11.18|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Services Cloud : Microsoft veut appliquer la conformité au RGPD partout|https://www.silicon.fr/services-cloud-microsoft-veut-appliquer-la-conformite-rgpd-partout-326317.html]]|Microsoft GDPR|
|2019.11.18|//Microsoft//| → [[Introducing more privacy transparency for our commercial cloud customers|https://blogs.microsoft.com/eupolicy/2019/11/18/introducing-privacy-transparency-commercial-cloud-customers/|https://blogs.microsoft.com/eupolicy/2019/11/18/introducing-privacy-transparency-commercial-cloud-customers/]]|Microsoft GDPR|
|2019.11.18|The Register| → [[You're about to gouda major change in Microsoft cloud security after Redmond agrees to go Dutch on data|https://www.theregister.co.uk/2019/11/18/microsoft_gdpr_moj_deal/]]|Microsoft GDPR|
|2019.11.18|CBR Online| → [[Microsoft Buckles Under EU Pressure: Changes Cloud Contracts to Reflect "Data Controller" Role|https://www.cbronline.com/news/microsoft-cloud-terms]]|Microsoft GDPR|
|2019.11.19|Le Monde Informatique[>img[iCSF/flag_fr.png]]| → [[Microsoft révise ses contrats de services cloud pour l'Union européenne|https://www.lemondeinformatique.fr/actualites/lire-microsoft-revise-ses-contrats-de-services-cloud-pour-l-union-europeenne-77118.html]]|Microsoft GDPR|
|2019.11.18|DZone|![[The Complete Docker Collection|https://dzone.com/articles/the-complete-docker-collection-tutorials]]|Docker Tutorials|
|2019.11.18|DZone|[[Containers vs. Serverless|https://dzone.com/articles/containers-vs-serverless]]|Containers Serverless|
|2019.11.18|TechBeacon|[[Why you should shift your cloud security strategy up stack|https://techbeacon.com/security/why-you-should-shift-your-cloud-security-strategy-stack]]|Strategy|
|2019.11.18|Shivbihari Pandey|[[Million Users PII Leak Data Leak|https://medium.com/bugbountywriteup/million-users-pii-leak-attack-288c5e37b283]]|Data_Leak|
|2019.11.18|//Gremlin//|[[Simple Kubernetes Targeting for Your Chaos Experiments|https://www.gremlin.com/blog/simple-kubernetes-targeting-for-your-chaos-experiments/]]|Kubernetes Chaos_Engineering|
|2019.11.18|BetaNews|[[Chaos engineering platform improves Kubernetes container reliability|https://betanews.com/2019/11/18/chaos-engineering-kubernetes/]]|Kubernetes Chaos_Engineering|
|2019.11.18|//Threatpost//|[[Office 365 Admins Targeted in Ongoing Phishing Scam|https://threatpost.com/office-365-admins-phishing/150352/]]|O365 Phishing|
|2019.11.18|//Sysdig//|[[Announcing the Cloud Native Security Hub|https://sysdig.com/blog/cloud-native-security-hub/]]|Sharing Configurations|
|2019.11.18|//Cavirin//|![[Cavirin Free for CIS benchmark now available on AWS and GCP|https://www.helpnetsecurity.com/2019/11/18/cavirin-free/]]|Benchmarking|
|2019.11.18|//Cavirin//| → [[Cavirin Platform Comparison|https://www.cavirin.com/environments/cavirin-free.html]]|Benchmarking|
|2019.11.28|//Tripwire//|[[Security for Cloud Services: SaaS Deep Dive|https://www.tripwire.com/state-of-security/security-data-protection/cloud/security-cloud-services-saas-deep-dive/]] (1/3)|SaaS|
|2019.11.18|//DataDog//|[[8 Facts about Real-World Container Use|https://www.datadoghq.com/container-report/]]|Containers Survey|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Novembre 2019]]>>
[>img(200px,auto)[iCSF/CCSEP2019.png]]Pour s'inscrire à la ''Cloud & Cyber Security Expo'' et disposer une deuxième aperçu du programme des conférences gratuites :

Suivez le lien → ''[[CloudSecurityAlliance.fr/go/jbls|https://CloudSecurityAlliance.fr/go/jbls]]''

[img(auto,60px)[iCSF/CCSA19h.jpg][https://CloudSecurityAlliance.fr/go/jbls]]
!CSA Congress EMEA 2019
[>img(250px,auto)[iCSA/201911DE-Berlin.jpg]]Après Amsterdam en 2012, et Madrid en 2016, le ''CSA Congress EMEA'' se déroulera à Berlin du 20 et 21 novembre 2019, après 2 jours de formations CSA
La [[Cloud Security Alliance]] est donc fière d'accueillir le Congrès 2019 de l'EMEA dans les locaux de son nouveau siège européen de Berlin.
Cette conférence de 4 jours comprendra 2 jours de formations, puis 2 jours de sessions de présentations et des possibilités de réseautage pour les professionnels de la sécurité du Cloud. Les participants pourront assister à un large éventail de présentations et de discussions sur des sujets d'actualité en matière de recherche, développement, pratiques et exigences liées à la sécurité dans le Cloud.
Cette année marque le dixième anniversaire de la CSA. Depuis sa création, la CSA s'est consacrée à la définition et à la sensibilisation aux bonnes pratiques afin d'assurer un environnement informatique dans le Cloud sécurisé partout dans le monde. Le congrès CSA EMEA est l'occasion pour nous de réfléchir aux expériences acquises par les entreprises et les fournisseurs alors que le Cloud est devenu le principal système informatique prédominant. Nous explorerons également de nouvelles frontières qui accélèrent le changement en matière de sécurité de l'information, telles que l'intelligence artificielle, le blockchain et l'IoT.
__Agenda :__[>img(250px,auto)[iCSA/JBICE.jpg]]
* Lundi 18 et mardi 19 novembre : formations
** ''RGPD'' : les 18 et 19
** ''CCSK'' : le 18
** ''Cloud Governance & Compliance Training Course'' : le 19
* Mercredi 20 et jeudi 21 novembre : le ''CSA Congress EMEA''
__Lieu :__
* Hotel Adlon Kempinski — Unter den Linden 77, 10117 Berlin, Germany
* Lien : ''[[CloudSecurityAlliance.fr/go/jBjH/|https://cloudsecurityalliance.fr/go/jBjH/]]''
__Appel à présentations :__ --[[ici|2019.03.30 - CSA Congress EMEA 2019 - Appel à présentations]]-- clôturé.
Pour en savoir plus et s'incrire :
* Lien → ''[[CloudSecurityAlliance.fr/go/jBjE/|https://cloudsecurityalliance.fr/go/jBjE/]]''
!Communiqué de presse "//CSA's Certificate of Cloud Computing Knowledge Plus Labs Are Now Available on Microsoft Azure Cloud Platform //"
[>img(200px,auto)[iCSA/J73CCSK.png]]
<<<
//Expansion gives Microsoft users equal access and functionality on the Azure platform

''SEATTLE and BERLIN – CSA EMEA CONGRESS – Nov. 20, 2019'' – The ''Cloud Security Alliance'' (''CSA''), the world's leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today announced that the hands-on labs available as part of the ''Certificate of Cloud Security Knowledge'' ([[CCSK]]) ''Plus'' coursework are now available on the ''Microsoft Azure'' cloud platform. Previously available only on ''Amazon Web Services'' (''AWS''), now Microsoft users will have equal access and functionality on the Azure platform, expanding the number of users who can now benefit from ''CCSK'' training and demonstrate their technical knowledge, skills, and abilities to use controls tailored to the cloud effectively.

"We're extremely excited to be able to expand the availability of our ''CCSK Plus'' training to ''Microsoft Azure'' cloud platform users looking to establish a baseline of security best practices when dealing with a broad array of responsibilities, from cloud governance to configuring technical security controls" said Ryan Bergsma, Training Program Director, ''CSA''.

The lecture-only ''CCSK Foundation'' course begins with the fundamentals, then increases in complexity as it works through all 16 domains of the ''CSA Security Guidance'', recommendations from the ''European Union Agency for Network & Information Security'' (''ENISA''), and an overview of the ''Cloud Controls Matrix'' (''CCM'').

The ''CCSK Plus'' includes expanded material and offers extensive hands-on activities that reinforce classroom instruction. During the lab sessions, students engage in a scenario of bringing a fictional organization securely into the cloud, allowing them to apply their knowledge by performing a series of activities that would be required in a real-world ''Microsoft Azure'' cloud platform or ''AWS'' environments.

Regardless of whether a student opts to prepare with the ''CCSK Foundation'' or the 'CCSK Plus'' course, the vendor-neutral ''CCSK'' tests for a broad foundation of cloud security knowledge, covering such topics as architecture, governance, compliance, operations, encryption, and virtualization. Those interested in taking the exam can also choose to take advantage of a variety of ''CCSK'' training programs, including free self-study prep courses, in-person training sessions, and instructor-led online classes. To date, thousands of IT and security professionals have upgraded their skillsets and careers by obtaining the ''CCSK''.The exam is also covered under the U.S. Dept. of Veterans Affairs GI Bill®.

Among the benefits of earning the ''CCSK'' are:
* Proven competency in key cloud security issues through an organization that specializes in cloud research
* Increased employment opportunities by filling the skills-gap for cloud-certified professionals
* Demonstrated technical knowledge, skills, and abilities to use controls tailored to the cloud effectively
* Ability to establish a baseline of security best practices when dealing with a broad array of responsibilities, from cloud governance to configuring technical security controls
Serves as a complement to other credentials//
<<<
&rArr; Lire le [[communiqué de presse|https://CloudSecurityAlliance.fr/go/jbka/]] sur le site de la CSA.
Dans le cadre du Congrès Européen du CSA, 4 nouveaux documents ont été publiés ou mis à jour :
* "''Beyond the General Data Protection Regulation (GDPR)''"
<<<
//Data residency insights from around the world. This study reveals the top data protection concerns and strategies of more than 800 senior business professionals from eight countries and a range of industries. Beyond the European Union's General Data Protection Regulation (GDPR) and other regulatory developments, enterprises think data privacy can create competitive advantage. What drives their decisions and investments in data management? Do they place their faith in cloud providers? Are they prepared to meet regulatory mandates and exceed customer expectations?//
<<<
** ⇒ https://cloudsecurityalliance.org/artifacts/beyond-the-general-data-protection-regulation-gdpr/
* "''Code of Conduct (CoC): Statement of Adherence 3rd Party Certification''"
<<<
//CSA PLA Code of Conduct for GDPR Compliance provides a consistent and comprehensive framework for complying with the EU's GDPR. The CSA PLA Code of Conduct for GDPR Compliance is designed to be an appendix to a Cloud Services Agreement to describe the level of privacy protection that a Cloud Service Provider will provide.//
<<<
** ⇒ https://cloudsecurityalliance.org/artifacts/code-of-conduct-coc-statement-of-adherence-3rd-party-certification/
* "''PLA Code of Conduct (CoC): Statement of Adherence Self-Assessment''"
<<<
//CSA PLA Code of Conduct for GDPR Compliance provides a consistent and comprehensive framework for complying with the EU's GDPR. The CSA PLA Code of Conduct for GDPR Compliance is designed to be an appendix to a Cloud Services Agreement to describe the level of privacy protection that a Cloud Service Provider will provide.//
<<<
** ⇒ https://cloudsecurityalliance.org/artifacts/pla-code-of-conduct-coc-statement-of-adherence-self-assessment/
* "''Guidance for submitting the CSA Code of Conduct (CoC) for GDPR Compliance Self-Assessment''"
<<<
//The CSA CoC for GDPR Compliance Self-Assessment is the voluntary publication of a CSP's self-assessment results based on the requirements specified in the PLA Code of Practice (CoP).//
<<<
** ⇒ https://cloudsecurityalliance.org/artifacts/guidance-for-submitting-the-csa-code-of-conduct-coc-for-gdpr-compliance-self-assessment/
!"//Colorado Chapter Forum 2019 Presentations//"
[>img(auto,150px)[iCSA/JB7-USCO.jpg]][>img(auto,150px)[iCSA/IB8-USCO.jpg]]Le ''Forum CSA du chapitre du Colorado'' s'est tenu à Denver le 7 novembre 2019.

Les 7 présentations sont maintenant disponibles en téléchargement :
* "''Change is Simply an Act of Survival''" par Bil Harmer	
* "''Data Protection Controls for the Cloud''" par Toby Zimmerer	
* "''Identity Round Robin Workshop Serverless''" par AWS Security	
* "''Taking Compliance to the Cloud''" par Tim Weil
* "''Attackers Battle for Hijacked Resources''" par James Condon
* "''Are Your Cloud Servers Under Attack''" par Brian Hileman
* "''Shared Responsibility Model in the Age of Cloud''" par Janelle Hsia

Les présentations peuvent être téléchargées individuellement ou en une seule fois.
Lien de téléchargement du paquet complet &rArr; ''[[CloudSecurityAlliance.fr/go/jbip/|https://CloudSecurityAlliance.fr/go/jbip/]]
!1 - Les nouveautés CSA de la semaine du 11 au 17 novembre 2019
* Publication : Nouvelle version 3.1 de la ''CAIQ'' +++*[»]> <<tiddler [[2019.11.15 - Publ : CAIQ version 3.1]]>>=== [>img[iCSF/cloud-security-alliance-fr.png]]
* Blog : Évolution des Technologies et Simplification +++*[»]> <<tiddler [[2019.11.15 - Blog : Evolution des Technologies et Simplification]]>>=== 
* Blog : Les principales erreurs de configuration à éviter+++*[»]> <<tiddler [[2019.11.14 - Blog : 4 erreurs de configuration]]>>=== 
* Actu : Nouvelle ''demande de validation de la traduction en français de 3 documents CSA'' (CCM, CAIQ et PLA CoC) +++*[»]> <<tiddler [[2019.11.13 - Actu : Demande de validation de la traduction en français de 3 documents CSA]]>>=== 
!2 - Veille Web
La +++*[Veille Web]> <<tiddler [[2019.11.10 - Veille Hebdomadaire]]>>=== avec plus de 60 liens
* Rapports : Blackblaze, Centrify, Firemon, ThousandEyes+++*[»]>
|2019.11.13|//ThousandEyes//|[[ThousandEyes Annual Research Report Reveals Notable Performance Variations Between AWS, GCP, Azure, Alibaba and IBM Cloud|https://vmblog.com/archive/2019/11/13/thousandeyes-annual-research-report-reveals-notable-performance-variations-between-aws-gcp-azure-alibaba-and-ibm-cloud.aspx]] ([[rapport|https://www.thousandeyes.com/resources/cloud-performance-benchmark-report-november-2019]])|Report|
=== 
* Conférence : future présentation sur les vulnérabilités liées aux APIs à la BlackHat Europe
* Pannes et attaques : nouveaux prestataires Cloud attaqués par des ransomawares
* Divers : retour sur la vulnérabilité "baseStricker" sur O365, Chaos Engineering pour Kubernetes, Phishing O365, traitement d'incidents
!3 - Conférences et Salons
* Le programme de la ''Cloud & Cyber Security Expo'' des ''27 et 28 novembre'' à Paris est partiellement disponible :
** ''Deuxième'' teaser et inscription gratuite +++*[»]> <<tiddler [[2019.11.01 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (2/3)]]>>=== 
** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Novembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.11.17|
|2019.11.17|//Tripwire//|[[MITRE ATT&CK October Update: Extending to the Cloud|https://www.tripwire.com/state-of-security/security-data-protection/cloud/mitre-attck-extending-cloud/]]|MITRE|
|2019.11.17|//Tripwire//|[[How to Implement an Efficient Cloud Security Strategy: The Experts Guide|https://www.tripwire.com/state-of-security/security-data-protection/cloud/efficient-cloud-security-strategy-experts-guide/]]|Strategy|
|>|>|>|!2019.11.16|
|2019.11.16|Ars Technica|[[Breach affecting 1 million was caught only after hacker maxed out target's storage|https://arstechnica.com/information-technology/2019/11/breach-affecting-1-million-was-caught-only-after-hacker-maxed-out-targets-storage/]]|DataBreach InfoTrax|
|>|>|>|!2019.11.15|
|2019.11.15|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Cloud du Pentagone : face à Microsoft, Amazon contre-attaque pour JEDI|https://www.silicon.fr/cloud-pentagone-microsoft-amazon-contre-attaque-jedi-326209.html]]|Government JEDI|
|2019.11.15|Informatique News[>img[iCSF/flag_fr.png]]| → [[Amazon conteste le choix d'Azure sur le contrat JEDI|https://www.informatiquenews.fr/amazon-conteste-le-choix-de-microsoft-sur-le-contrat-jedi-64729]]|Government JEDI|
|2019.11.15|Breaking Defense| → [[Amazon's Big JEDI Gamble ANALYSIS|https://breakingdefense.com/2019/11/amazons-big-jedi-gamble-analysis/]]|Government JEDI|
|2019.11.15|Container Journal|![[5 Ways to Chaos Test Kubernetes|https://containerjournal.com/topics/container-security/5-ways-to-chaos-test-kubernetes/]]|Kubernetes Chaos_Engineering|
|2019.11.15|//Vanson Bourne//|[[Cloud services backup: survey finds major gap between perceptions and realities|https://www.continuitycentral.com/index.php/news/technology/4627-cloud-services-backup-survey-finds-major-gap-between-perceptions-and-cloud-realities]] ([[rapport .pdf|https://www.4sl.com/wp-content/uploads/2019/11/research-report-nov-2019.pdf]])|Backups|
|2019.11.15|Bleeping Computer|[[New NextCry Ransomware Encrypts Data on NextCloud Linux Servers|https://www.bleepingcomputer.com/news/security/new-nextcry-ransomware-encrypts-data-on-nextcloud-linux-servers/]]|NextCloud Ransomware|
|>|>|>|!2019.11.14|
|2019.11.14|Journal du Net[>img[iCSF/flag_fr.png]]|[[Prêt pour le cloud souverain 2.0 ?|https://www.journaldunet.com/solutions/expert/72072/pret-pour-le-cloud-souverain-2-0.shtml]]|Sovereign_Cloud|
|2019.11.14|Wall Street Journal|[[Amazon to Protest Pentagon Contract Award to Microsoft|https://www.wsj.com/articles/amazon-to-protest-pentagon-contract-award-to-microsoft-11573769321]]|Government JEDI|
|2019.11.14|Silicon Angle| → [[Amazon protests Pentagon's cloud contract award, citing 'unmistakable bias'|https://siliconangle.com/2019/11/14/amazon-protests-pentagons-cloud-computing-contract-award-citing-unmistakable-bias/]]|Government JEDI|
|2019.11.14|CBR Online|[[Codeanywhere Blames GCP Outage for Vanished Work|https://www.cbronline.com/news/codeanywhere-gcp-projects-missing]]|GCP Outage|
|2019.11.14|//Microsoft//|![[Changing security incident response by utilizing the power of the cloud-DART tools, techniques, and procedures: part 1|https://www.microsoft.com/security/blog/2019/11/14/security-incident-response-utilizing-cloud-dart-tools-techniques-procedures-part-1/]] (1/3)|Incident_Response|
|2019.11.14|//PhishLabs//|[[Active Office 365 Credential Theft Phishing Campaign Targeting Admin Credentials|https://info.phishlabs.com/blog/active-office-365-phishing-campaign-targeting-admin-credentials]]|O365 Phishing|
|2019.11.16|Bleeping Computer| → [[Microsoft Office 365 Admins Targeted by Ongoing Phishing Campaign|https://www.bleepingcomputer.com/news/security/microsoft-office-365-admins-targeted-by-ongoing-phishing-campaign/]]|O365 Phishing|
|2019.11.14|//Tripwire//|[[Aligning SECaaS with Your Organization's Cloud Security Needs|https://www.tripwire.com/state-of-security/security-data-protection/cloud/aligning-secaas-organizations-cloud-security-needs/]]|SECaaS|
|2019.11.14|//Microsoft//|[[Azure Container Registry: Preview of diagnostic and audit logs|https://azure.microsoft.com/en-us/blog/azure-container-registry-preview-of-diagnostics-and-audit-logs/]]|Azure Containers Tools|
|2019.11.14|//LogRythm//|[[Examining the baseStriker Vulnerability|https://logrhythm.com/blog/examining-the-basestriker-vulnerability/]]|O365 Vulnerability baseStricker|
|2019.11.14|//Compare The Cloud//|[[Cloud and Web Application Security: Growing Confidence and Emerging Gaps|https://www.comparethecloud.net/articles/cloud-and-web-application-security-growing-confidence-and-emerging-gaps/]]|Confidence|
|2019.11.14|//Cyware//|![[Many public cloud infrastructures suffer from serious security loophole, researchers say|https://cyware.com/news/many-public-cloud-infrastructures-suffer-from-serious-security-loophole-researchers-say-4c79a693]]|Vulnerability|
|2019.11.14|//AlienVault//|[[Cybersecurity: top of mind Q and A|https://www.alienvault.com/blogs/security-essentials/cybersecurity-questions-and-answers]]|Misc|
|2019.11.14|//Sysdig//|[[Securing Google Cloud Run serverless workloads|https://sysdig.com/blog/securing-google-cloud-run/]]|GCP|
|2019.11.14|//Sensu//|[[Kubernetes 101|https://blog.sensu.io/kubernetes-101]]|Kubernetes|
|2019.11.14|//Syxsense//|[[Worried about Cloud Security? Why On-Premise is More Dangerous|https://www.syxsense.com/why-on-premise-is-more-dangerous]]|Risks|
|>|>|>|!2019.11.13|
|2019.11.13|Economie Numérique[>img[iCSF/flag_fr.png]]|[[Cloud souverain français : vers un protectionnisme de la donnée ?|http://blog.economie-numerique.net/2019/11/13/cloud-souverain-francais-vers-un-protectionnisme-de-la-donnee/]]|Sovereign_Cloud|
|2019.11.13|ComputerWeekly|[[Taking responsibility for security in the cloud|https://www.computerweekly.com/feature/Taking-responsibility-for-security-in-the-cloud]]|Responsibility|
|2019.11.13|GBHackers on Security|[[Telegram MTProxy Used to Launch DDoS Attack Against Cloud Service Provider Arvan – Peaks Up to 5,000 Requests Per Second|https://gbhackers.com/telegram-mtproxy/]]|DDoS|
|2019.11.13|Breaking Defense|[[Can DoD Get Speed & Security With The Cloud?|https://breakingdefense.com/2019/11/can-dod-get-speed-security-with-the-cloud/]]|DevSecOps|
|2019.11.13|Silicon Angle|[[Google launches new service for monitoring multicloud networks|https://siliconangle.com/2019/11/13/google-launches-new-service-monitoring-multicloud-networks/]]|GCP|
|2019.11.13|//Avanan//|[[What Is a Cloud Access Security Broker (CASB)?|https://www.avanan.com/blog/what-is-a-casb]]|CASB|
|2019.11.13|//AlertLogic//|[[Managing Cybersecurity During Cloud Migration|https://blog.alertlogic.com/managing-cybersecurity-during-cloud-migration/]]|Migration|
|2019.11.13|//Nutanix//[>img[iCSF/flag_fr.png]]|[[Enterprise Cloud Index : 73 % des entreprises rapatrient leurs applications du cloud public vers le cloud privé|http://www.globalsecuritymag.fr/Enterprise-Cloud-Index-73-des,20191114,92735.html]]|Report|
|2019.11.13|//ThousandEyes//|[[ThousandEyes Annual Research Report Reveals Notable Performance Variations Between AWS, GCP, Azure, Alibaba and IBM Cloud|https://vmblog.com/archive/2019/11/13/thousandeyes-annual-research-report-reveals-notable-performance-variations-between-aws-gcp-azure-alibaba-and-ibm-cloud.aspx]] ([[rapport|https://www.thousandeyes.com/resources/cloud-performance-benchmark-report-november-2019]])|Report|
|2019.11.13|//ThousandEyes//|[[Top Takeaways from the Cloud Performance Benchmark|https://blog.thousandeyes.com/top-takeaways-cloud-performance-benchmark/]]|Performance|
|2019.11.18|CBR Online| → [[The Cloud Providers Ranked by Network Performance|https://www.cbronline.com/news/fastest-cloud-thousandeyes]]|Performance|
|2019.11.13|//Microsoft//|[[The refreshed Azure AD Identity Protection is now generally available|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/The-refreshed-Azure-AD-Identity-Protection-is-now-generally/ba-p/1002916]]|AzureAD|
|2019.11.13|//Microsoft//|[[Azure Container Registry: preview of repository-scoped permissions|https://azure.microsoft.com/en-us/blog/azure-container-registry-preview-of-repository-scoped-permissions/]]|Azure Container Registry|
|2019.11.13|//Akamai//|[[Security at the Edge - What is Gartner's SASE & why does it matter?|https://blogs.akamai.com/2019/11/security-at-the-edge-what-is-gartners-sase-why-does-it-matter.html]]|SASE|
|>|>|>|!2019.11.12|
|2019.11.12|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[Les développeurs, insoupçonnés maillons faibles de la sécurité des clouds|https://www.lemondeinformatique.fr/actualites/lire-les-developpeurs-insoupconnes-maillons-faibles-de-la-securite-des-clouds-77046.html]]|SecDevOpsDev|
|2019.11.12|//Blackblaze//|[[Backblaze Hard Drive Stats Q3 2019|https://www.backblaze.com/blog/backblaze-hard-drive-stats-q3-2019/]]|Reliability|
|2019.11.12|//Uptycs//|![[Conducting A Vulnerability Assessment: A Step-By-Step Guide For Linux Workloads In The Cloud|https://www.uptycs.com/blog/how-to-conduct-a-vulnerability-assessment]]|Vulnerability_Assessment|
|2019.11.12|//PaloAlto Networks//|[[Is CASB Alone Enough? Long Live SASE|https://blog.paloaltonetworks.com/2019/11/cloud-casb-sase/]]|SASE|
|2019.11.12|//Trustwave//|[[3 Multi-Cloud Environment Challenges to Overcome|https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/3-multi-cloud-environment-challenges-to-overcome/]]|Multi_Cloud|
|2019.11.12|//Lob//|[[Detecting Manual AWS Console Actions|https://arkadiyt.com/2019/11/12/detecting-manual-aws-console-actions/]]|AWS_Console|
|2019.11.12|//Sysdig//|[[Incident response in Kubernetes with Sysdig's Activity Audit|https://sysdig.com/blog/cloud-native-incident-response/]]|Kubernetes Incident_Response|
|2019.11.12|//Centrify//[>img[iCSF/flag_fr.png]]|[[Comment sécuriser l'accès aux opérations de cloud : 5 conseils|https://www.undernews.fr/reseau-securite/comment-securiser-lacces-aux-operations-de-cloud-5-conseils.html]]|Zero_Trust|
|2019.11.12|//Cyberark//|[[New Open Source Offerings Simplify Securing Kubernetes|https://www.cyberark.com/blog/new-open-source-offerings-simplify-securing-kubernetes/]]|Kubernetes Tools|
|2019.11.12|//Firemon//|[[State of the Firewall Report 2019: Zero-Touch Automation is More Headline than Reality, Network Complexity and Lack of Visibility Are Key Issues|https://www.firemon.com/state-of-the-firewall-report-2019/]] ([[rapport|https://www.firemon.com/2019-state-of-the-firewall-report/]])|Report|
|2019.11.12|//Fugue//|[[Cloud Network Security 101: AWS VPC Endpoints|https://www.fugue.co/blog/network-security-vpc-endpoints-101]]|VPC|
|>|>|>|!2019.11.11|
|2019.11.11|HelpNet Security|![[Speeding MTTR when a third-party cloud service is attacked|Outage Best_Practices|
|2019.11.11|//XM Cyber//|![[Researchers Find New Approach in Attacking Cloud Infrastructure|https://xmcyber.com/researchers-find-new-approach-in-attacking-cloud-infrastructure/]]|APIs|
|2019.11.11|BlackHat Europe| → [[Inside Out - The Cloud Has Never Been So Close|https://www.blackhat.com/eu-19/briefings/schedule/index.html#inside-out---the-cloud-has-never-been-so-close-17797]]|APIs|
|2019.11.11|Dark Reading| → [[Researchers Find New Approach to Attacking Cloud Infrastructure|https://www.darkreading.com/cloud/researchers-find-new-approach-to-attacking-cloud-infrastructure/d/d-id/1336327]]|APIs|
|2019.11.11|//Heimdal//|[[Ransomware as a Service (RaaS) – A Contemporary Mal du siècle?|https://heimdalsecurity.com/blog/ransomware-as-a-service/]]|Ransomware|
|2019.11.11|//Smarter ASP//|[[Your hosting accounts are under attack|http://status.smarterasp.net/post/your-hosting-accounts-are-under-attack]]|Attack Ransomware|
|2019.11.11|ZDnet|[[Major ASP.NET hosting provider infected by ransomware|https://www.zdnet.com/article/major-asp-net-hosting-provider-infected-by-ransomware/]]|Attack Ransomware|
|2019.11.12|//MSSP Alert//| → [[Ransomware Attack Hits Web Hosting Provider SmarterASP|https://www.msspalert.com/cybersecurity-breaches-and-attacks/ransomware/smarterasp-hit/]]|Attack Ransomware|
|2019.11.11|//Centrify//|[[New Report from Centrify Reveals That the Majority of Organizations Still Misunderstand the Shared Responsibility Model for Cloud Security|https://www.centrify.com/about-us/news/press-releases/2019/reducing-risk-cloud-migration-report/]]|Report|
|2019.11.13|HelpNet Security| → [[The leading challenge facing cloud migration projects is security|https://www.helpnetsecurity.com/2019/11/13/cloud-migration-projects/]]|Report|
|2019.11.11|//Zyxel//|[[The Role Of SaaS In Network Security|https://www.informationsecuritybuzz.com/articles/the-role-of-saas-in-network-security/]]|Network_Security|
|2019.11.11|//Edgewise Networks//|[[Thwarting Graboid and Protecting Containers with Zero Trust|https://www.cisomag.com/thwarting-graboid-and-protecting-containers-with-zero-trust/]]|Containers Zero_Trust|
|2019.11.11|//JumpCloud//|[[Why Use a Directory Service?|https://jumpcloud.com/blog/build-directory-service/]]|Directory|
|2019.11.11|//JumpCloud//|[[RADIUS Server In Azure|https://jumpcloud.com/blog/radius-server-azure/]]|Azure RADIUS|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Novembre 2019]]>>
!"//Consensus Assessment Initiative Questionnaire (CAIQ) v3.1//"
[>img(150px,auto)[iCSA/CAIQ31.png]]Publication de la nouvelle version ''CAIQ 3.1''
<<<
//Cloud Security Alliance (CSA) would like to present the next version of the Consensus Assessments Initiative Questionnaire (CAIQ) v3.1.
The CAIQ offers an industry-accepted way to document what security controls exist in IaaS, PaaS, and SaaS services, providing security control transparency.
It provides a set of Yes/No questions a cloud consumer and cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the Cloud Controls Matrix (CCM).
Therefore, it helps cloud customers to gauge the security posture of prospective cloud service providers and determine if their cloud services are suitably secure.
CAIQ v3.1 represents a minor update to the previous CAIQ v3.0.1.
In addition to improving the clarity and accuracy, it also supports better auditability of the CCM controls.
The new updated version aims to not only correct errors but also appropriately align and improve the semantics of unclear questions for corresponding CCM v3.0.1 controls.
In total, 49 new questions were added, and 25 existing ones were revised.
For this new CAIQ version, CSA took into account the combined comprehensive feedback that was collected over the years from its partners, the industry and the CCM working group.//
[...]
<<<
&rArr; [[Détail|https://CloudSecurityAlliance.fr/go/jbfp/]] sur le site de la CSA.
&rArr; Fichier [[XLSX|https://CloudSecurityAlliance.fr/go/jbfx/]] sur le site de la CSA.
!"//Keeping Up With Changing Technology by Reducing Complexity//"
[>img(150px,auto)[iCSA/JBFBK.jpg]]Article de blog publié le 14 novembre 2019 — Rédigé par John DiMaria, CSA Research Fellow, Assurance Investigatory Fellow, Cloud Security Alliance
<<<
//+++*[Fox News reported]> https://www.foxbusiness.com/industrials/boeing-should-reconsider-pilots-response-time-ntsb === that in answer to the previous Boeing 737 accidents, the Federal safety officials say, "Boeing should consider how cockpit confusion can slow the response of pilots who are dealing with the kind of problem that likely caused two airliners to crash in the past year."
"They suggest that Boeing underestimated the time it takes for pilots to diagnose and react when they are being bombarded by multiple, cascading warning alerts."
Think about it; they were bombarded by multiple, cascading warning alerts that taxed their ability to respond in a timely fashion. There were two issues there:
# Too much complexity was built into the system
# They underestimated the time it takes to diagnose and react.
''The more complex systems become, the less secure they become, even though security technologies improve.''
While there's nothing wrong with improving technology, we always need to consider the human element since leveraging multiple systems can create a fragmented environment. Underlying the current security failings is a critical, under appreciated problem -- fragmentation.

''Root Cause of Cost Increase & Poor Data Governance''
Fragmentation is at the heart of the ineffectiveness of our efforts to continue to improve. Fragmentation happens when we focus on individual parts without adequately appreciating their relation to the evolving whole. This unbalance is one of the root causes of the more obvious security issues of continued cost increases, poor data governance, and inadequate planning. Not addressing this problem is essential because fragmentation leads to well-intentioned actions that sometimes have unintended consequences that often make things worse.
''Unintended consequences of fragmentation:''
* Inefficiency
** Narrowly focused programs and services is an excellent strategy for reducing the security budget, but it is not a strategy for efficiently implementing an effective holistic information/cybersecurity system. Efficient strategic planning should analyze and prioritize based on a holistic analysis of risk. This analysis should include all applicable elements of people, process and technology. It should hone in on the critical scope and then implement the applicable controls that are justified based on that risk assessment.
* Ineffectiveness
** It is no fluke that technologically has advanced, yet security breaches continue to grow exponentially. Risk Based Securities mid-year report noted that 2019 is on track to be the "worst year on record" for breach activity. Spending more on the parts has not improved the whole. Today many of the efforts toward improving security are directed at narrow programs with insufficient attention to the larger scope they are trying to affect. Many times scope is the problem because the scope is not "fit for purpose." The lack of an integrative way of addressing security and implementing proper controls only addresses the short-term problems and may keep costs down (for the time being) but ignores the greater objective of addressing the total system within the context of the organization.
* Commoditization
** I was on a website of an organization that was claiming "X Security Controls will stop 85% of Cyber Attacks". Not "address," not "help mitigate" but STOP! Seriously? Further, if you implement X more of the controls, you'll prevent 97% of attacks.
** Treating security as a commodity can unintentionally deemphasize the seriousness and real scope of the issue. Especially when addressing cloud security, that can be a perilous road to go down. The cloud is a dynamic environment where things are always changing, especially security threats. You have to first understand what needs to be protected and from what. Risk assessment is a real-time living process and the controls change as the environment changes. Cybersecurity is not a science; at least not yet.
** Some advertised solutions focus on delivering their well-intentioned services without consideration of their effect on the whole system or the reality that scope and specific SLA's that change the way you approach cybersecurity strategy. They also ignore how many and what controls need to be put in place. The true urgency of cybersecurity is reduced when it is treated as a commodity. Conversely, other solutions take the approach that the more complexity, the better.

''How can we start being a part of the solution?''
The CSA Cloud Control Matrix ([[CCM]]), The Consensus Assessments Initiative Questionnaire ([[CAIQ]]) and the CSA [[STAR]] Program come together as an integrated approach that helps companies understand the fundamental problem of fragmentation and how to reduce it. And the first step towards reducing fragmentation, is simply reducing complexity. Viewing security as an evolving integrated system instead of only as fragmented parts or small insignificant scopes that are not fit for purpose, can help our industry to feel hope where now there is skepticism. ''Transparency, trust and information sharing instead of detachment and isolation. Professional and corporate shared responsibility instead of narrow self-interest''.

''Here is my challenge...''
* Listen to my +++*[Podcast interview with Doctor Ron Ross; Senior Fellow at NIST]> https://www.buzzsprout.com/303731/1298485-the-growing-complexity-around-cybersecurity-and-evolving-technology-guest-dr-ron-ross-nist === "The growing complexity around cybersecurity and evolving technology."
* Take a deep dive into the [[STAR]] Program and the [[STAR]] Registry and then take a self-assessment using the CAIQ.
//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jbfb/]] sur le blog de la CSA.
!"//4 Common Cloud Misconfigurations & What To Do About Them//"
[>img(150px,auto)[iCSA/JBEBF.jpg]]Article de blog publié le 14 novembre 2019 — Rédigé par Kevin Tatum, IT Security Engineer chez ExtraHop
<<<
//In a +++*[recent report]> https://cloudsecurity.mcafee.com/cloud/en-us/forms/white-papers/wp-cloud-adoption-risk-report-iaas.html ===, McAfee uncovered the rise of Cloud-Native Breaches and the state of multi-cloud adoption. We'll define the top 4 cloud misconfiguration goofs from their list, how they can affect your organization, and what to do about them.
When it comes to personal data, the mid-2010s were a bit of a reckoning. Your credit card information, health records, and even your love life became subject to breaches. Today, nearly everyone can relate to the hassle of switching out a debit or credit card, and these issues persist-especially as enterprises move their IaaS (Infrastructure as a Service) to the cloud.
In recent years, nearly 70 percent of exposed records - 5.4 billion total - were caused by unintentional internet exposure due to misconfigured services and portals - services like Amazon Simple Storage Service, known as S3. (+++*[Luckily, S3 misconfiguration is a very avoidable issue]> https://www.extrahop.com/company/blog/2018/get-safe-smart-secure-on-aws-s3/ ===.)
As McAfee found, most of these misconfigurations go unreported and, in many cases, unnoticed.
If only 1% of IaaS issues are reported, that means a whole slew of companies inadvertently leak data or fail to report for fear of bad PR. Worse, one-quarter of the McAfee survey respondents said it takes longer than 24 hours to correct misconfigurations.
In summary, McAfee highlights significant visibility, reporting, and misconfiguration errors that are preventable. Here are the top offenders in the McAfee list and the ways they can affect your organization, followed by a remedy for these common problems.

__''4 Common Security Group Setting Misconfigurations''__

__1 -- Unrestricted Outbound Access__
Outbound traffic should always use the principle of minimalist authority. Many AWS users only configure inbound ports in security groups, but outbound ports can also be a huge security risk. Limiting outbound traffic helps direct traffic to only the applications and servers that need to communicate. This helps reduce the risk and impact of internal network scans, lateral movement, and data exfiltration.
Your servers may only need SSH or RDP inbound ports to manage them. It's rare for one of those application servers to SSH to all of the other servers in the network. Many common hacker tactics use random ports for Command and Control actions, reverse shells, or to spread malware.

__2 -- Unrestricted Access to Non-HTTP/HTTPS Ports__
Web servers are designed to host websites and web services to the internet, and they can also host other services like SSH or RDP for management or databases. But it's important to block these from the whole internet. If these ports remain improperly configured, it can open you up to attackers looking to exploit or brute force the authentication. If you open up these ports to the internet, make sure they're limited to accept traffic from particular addresses such as your office.

__3 -- Unrestricted Inbound Access on Uncommon Ports__
Some services use a high numbered TCP or UDP port to obfuscate what is running in the environment, but security through obscurity never really works. It doesn't protect you from a determined hacker or even a random internet scan. Some services also open uncommon ports without really letting you know.
Does your web server have a statistics page? Do you have PHPMyAdmin running on port 8443? Are you leaking Apache Tomcat services on port 8080? You must restrict high-level ports to only the necessary systems, and usually, that is not the internet. PHPMyAdmin on the internet makes us shudder.

__4 -- Unrestricted ICMP Access__
ICMP is a useful protocol, but leaving it open to the internet can leave you vulnerable to more straightforward, older attacks. One of the most common uses of ICMP is to use ICMP Echo to verify that your servers are online and responsive.
ICMP Echo is an excellent diagnostic tool for IT professionals. Unfortunately, it's also a great tool for hackers. A quick ping scan of the internet using Nmap or Fping can let attackers know that you have a server online, which becomes ripe for a focused attack. There are several more complicated ways to find a server on the internet, so why do a bad actor's job for them?
Attackers can use ICMP for much more than finding servers, however. As an example, a ping flood overwhelms a server with too many ICMP messages. Though simple, a ping flood is an effective type of Denial of Service attack, which becomes even more effective when multiple attackers or botnets are involved to create a Distributed Denial of Service (DDoS).
The ping sweep and ping flood may be ancient methods, but they're still put to use because they work. Do yourself a favor and block ICMP.

__''How Network Detection and Response (NDR) Can Help''__

Most cloud environments have dozens, if not hundreds, of these security risks. And really, each server needs its own set of rules.
While the ability to quickly build servers and services in the cloud has its advantages, it also comes with some of the most significant security risks. When you use default rules, it's easy to miss one rule on a single server - and if an appropriate rule is overlooked, your whole environment can quickly be compromised.
One reason cloud security has lagged so far behind traditional security is that, until very recently, network traffic in the cloud was extremely difficult to capture and parse effectively. Monitoring network communications in real time through network detection and response (NDR) is the quickest and easiest way for security teams to stay on top of complex, dynamic environments, and without NDR in the cloud, SecOps struggled to maintain the same deep visibility and rapid threat detection as is possible on-premises.
With the advent of traffic mirroring in AWS and Azure, that gap has finally begun to close.//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jbeb/]] sur le blog de la CSA.
[>img[iCSF/cloud-security-alliance-fr.png]]La [[Cloud Security Alliance]] a lancé la traduction de 3 outils majeurs dans 10 langues : allemand, danois, espagnol, italien, japonais, néerlandais, portugais, roumain, suédois, et ... français.
Il s'agit de feuilles Excel dans lesquelles il vous est demandé d'adapter les traductions ou de les commenter.
Pour chaque document, les 10 traductions sont dans un répertoire //Google Drive// dédié, et pour travailler sur la version française, il faut sélectionner le document commençant par "''FR-''"

Les 3 documents sont les suivants :
* "''Cloud Controls Matrix''" (CCM) : document "FR-CSA_CCM_v.3.0.1-09-01-2017_FINAL.xlsx"
:→ ''[[CloudSecurityAlliance.fr/go/j99c/|https://cloudsecurityalliance.fr/go/j99c/]]''
* "''Consensus Assessments Initiative Questionnaire''" (CAIQ) : document "FR-CAIQ_v3.0.1-09-01-2017_FINAL.xlsx"
:→ ''[[CloudSecurityAlliance.fr/go/j99q/|https://cloudsecurityalliance.fr/go/j99q/]]''
* "''Code of Conduct''" du "''Privacy Level Agreement''" (PLA CoC) : document "FR-CoC_GDPR_Annex_1_Compliance_Assessment_Template.xlsx"
:→ ''[[CloudSecurityAlliance.fr/go/j99p/|https://cloudsecurityalliance.fr/go/j99p/]]''

La date limite initiale était fixée en octobre 2019, mais est maintenant repoussée au ''1^^er^^ décembre 2019''.
[img(25%,1px)[iCSF/BluePixel.gif]]
!1 - Les nouveautés CSA de la semaine du 4 au 10 novembre 2019
* Publication : Présentations du ''CSA Summit'' au congrès (ISC)² +++*[»]> <<tiddler [[2019.11.04 - Publication : Présentations du CSA Summit au congrès (ISC)²]]>>=== [>img[iCSF/cloud-security-alliance-fr.png]]
* Blog : ''CMMC'', un nouveau protocole pour la conformité DoD +++*[»]> <<tiddler [[2019.11.06 - Blog : CMMC, un nouveau protocole pour la conformité DoD]]>>=== 
* Blog : Google et la ''Suprématie Quantique'' +++*[»]> <<tiddler [[2019.11.06 - Blog : Google et la Suprématie Quantique]]>>=== 
* Actu : Contribution CSA à deux documents de ''l'EU-SEC sur la certification'' +++*[»]> <<tiddler [[2019.11.07 - Actu : Contribution CSA à deux documents de l'EU-SEC sur la certification]]>>=== 
!2 - Veille Web
La +++*[Veille Web]> <<tiddler [[2019.11.10 - Veille Hebdomadaire]]>>=== avec plus de 50 liens
* Rapports : Gurucul, Rancher Labs, Rick's Cloud, Sophos
* Conférences : présentations au BSidesCT 2019, annonces Microsoft à Ignite 2019
* Divers : sécurité des containers, retour sur le SASE du Gartner
!3 - Conférences et Salons
* Le programme de la ''Cloud & Cyber Security Expo'' des ''27 et 28 novembre'' à Paris est partiellement disponible :
** ''Deuxième'' teaser et inscription gratuite +++*[»]> <<tiddler [[2019.11.01 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (2/3)]]>>=== 
** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== 
* Les inscriptions pour le ''Congrès Européen'' des ''18 au 21 novembre'' à Berlin sont toujours ouverte+++*[»]> <<tiddler [[2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]>>=== 
** Contactez-nous pour avoir une réduction sur votre inscription.+++*[»]> → [img(200px,auto)[iCSF/Email-CSA_FR.png]]=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Novembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.11.10|
|2019.11.10|BSidesCT 2019|[[Rethinking Privileged Access Management for Agile Clouds & Data Center Environments|http://www.irongeek.com/i.php?page=videos/bsidesct2019/2-01-rethinking-privileged-access-management-for-agile-clouds-data-center-environments-brian-gladstein]] ([[vidéo|http://www.youtube.com/watch?v=EMKDvB7zpf0]])|Conference Access_Management|
|2019.11.10|BSidesCT 2019|[[Event Injections: Sending Evil to the Cloud|http://www.irongeek.com/i.php?page=videos/bsidesct2019/1-02-event-injections-sending-evil-to-the-cloud-tal-melamed]] ([[vidéo|http://www.youtube.com/watch?v=NJOuXeFtgBU]])|Conference Attacks|
|2019.11.10|BSidesCT 2019|[[Building Castles in the Cloud: AWS Security and Self-Assessment|http://www.irongeek.com/i.php?page=videos/bsidesct2019/2-05-building-castles-in-the-cloud-aws-security-and-self-assessment-rami-mccarthy]] ([[vidéo|http://www.youtube.com/watch?v=W2I-b_b_-6M]])|Conference AWS|
|2019.11.10|Silicon Angle|![[As cloud security improves, a weak link emerges: people |https://siliconangle.com/2019/11/10/cloud-security-improves-weak-link-emerges-people/]]|Risks|
|>|>|>|!2019.11.08|
|2019.11.08|//TresorIT//|[[Should You Trust Your Cloud Storage Provider?|https://www.infosecurity-magazine.com/blogs/should-trust-cloud-storage-provider/]]|Storage|
|2019.11.08|//Sophos//|[[Exposed: Private Amazon S3 bucket exposure|https://news.sophos.com/en-us/2019/11/08/exposed-private-amazon-s3-bucket-exposure/]]|AWS Data_Leak|
|>|>|>|!2019.11.07|
|2019.11.07|Davis Wright Tremaine|[["CLOUD"s On the Horizon – How Law Enforcement Electronic Data Requests Are Going Global|https://www.dwt.com/blogs/privacy--security-law-blog/2019/11/global-law-enforcement-electronic-data-requests]]|Law_Enforcement|
|2019.11.07|The Hacker News|[[Gartner Says the Future of Network Security Lies with SASE|https://thehackernews.com/2019/11/network-security-sase.html]]|Network SASE|
|2019.11.07|//PaloAlto Networks//|[[Container Security: Vulnerability Management from Build to Run|https://blog.paloaltonetworks.com/2019/11/cloud-container-security/]]|Containers|
|2019.11.07|//Tripwire//|[[Thunder on the Horizon: 4 Security Threats for the Cloud|https://www.tripwire.com/state-of-security/risk-based-security-for-executives/connecting-security-to-the-business/thunder-horizon-4-security-threats-cloud/]]|Threats|
|2019.11.07|//Fugue//|[[Securing Cloud Environments Against Advanced Misconfiguration Risk with Fugue Best Practices|https://www.fugue.co/blog/securing-cloud-environments-against-advanced-misconfiguration-risk-with-fugue-best-practices]]|Best_Practices Framework|
|2019.11.07|//Fugue//| → [[Fugue Releases Best Practices Framework to Protect Against Advanced Cloud Misconfiguration Attacks|https://vmblog.com/archive/2019/11/07/fugue-releases-best-practices-framework-to-protect-against-advanced-cloud-misconfiguration-attacks.aspx]]|Best_Practices Framework|
|2019.11.07|//Reduxio//|[[Cloud Storage: Where Private and Public Diverge|https://vmblog.com/archive/2019/11/07/cloud-storage-where-private-and-public-diverge.aspx]]|Storage|
|2019.11.07|//JumpCloud//|[[How Cloud Services Maximize Cybersecurity|https://jumpcloud.com/blog/best-practices/cybersecurity-cloud-services/]]|Misc|
|2019.11.07|//Cloudflare//[>img[iCSF/flag_fr.png]]|[[Quoi de neuf en Francophonie?|https://blog.cloudflare.com/fr/quoi-de-neuf-en-francophonie/]]|Cloudflare|
|>|>|>|!2019.11.06|
|2019.11.06|Cloud Native Computing Foundation|[[Cloud Native Chaos Engineering – Enhancing Kubernetes Application Resiliency|https://www.cncf.io/blog/2019/11/06/cloud-native-chaos-engineering-enhancing-kubernetes-application-resiliency/]]|Kubernetes Chaos_Engineering Resilience|
|2019.11.06|Computer Weekly|[[Security Think Tank: Adapt security posture to your cloud model|https://www.computerweekly.com/opinion/Security-Think-Tank-Adapt-security-posture-to-your-cloud-model]]|Security_Posture|
|2019.11.06|//Rancher Labs//|[[Rancher Labs Industry Survey Shows Rapid Adoption of Containers and Kubernetes, But Challenges Remain|https://rancher.com/blog/2019/container-industry-survey-results]] ([[infographie|https://info.rancher.com/kubernetes-industry-survey-key-findings]])|Survey Kubernetes|
|2019.11.06|//Rancher Labs//| → [[Rancher Labs Industry Survey Highlights Rapid Adoption of Kubernetes for Production Workloads|https://www.businesswire.com/news/home/20191106005114/en/Rancher-Labs-Industry-Survey-Highlights-Rapid-Adoption]]|Survey Kubernetes|
|2019.11.08|Container Journal| → [[Survey Finds Kubernetes Clusters Are Multiplying|https://containerjournal.com/topics/container-ecosystems/survey-finds-kubernetes-clusters-are-multiplying/]]|Survey|
|2019.11.06|//Gurucul//|[[2020 Insider Threat Report|https://gurucul.com/2020-insider-threat-survey-report]]|Report Insider_Threats|
|2019.11.06|InfoSecurity Mag| → [[Cloud Covers Up Insider Threats|https://www.infosecurity-magazine.com/news/cloud-covers-up-insider-threats/]]|Report Insider_Threats|
|2019.11.06|HelpNet Security| → [[SIEM complexity and cloud visibility put companies at risk|https://www.helpnetsecurity.com/2019/11/08/siem-complexity/]]|Report Insider_Threats|
|2019.11.06|//PaloAlto Networks//|[[The Next Generation of Network Security Is Cloud-Delivered|https://blog.paloaltonetworks.com/2019/11/cloud-next-generation-network-security/]]|Network SASE|
|2019.11.06|//Tripwire//|[[Cloud Security Threats: Escaping the Egregious Eleven - Part One|https://www.tripwire.com/state-of-security/security-data-protection/cloud/cloud-security-threats-egregious-eleven-part-one/]] (1/2)|CSA Threats|
|2019.11.04|//Microsoft//|[[Microsoft Cloud Security solutions provide comprehensive cross-cloud protection|https://www.microsoft.com/security/blog/2019/11/06/microsoft-cloud-security-solutions-provide-comprehensive-cross-cloud-protection/]]|Azure|
|2019.11.06|//ExtraHop//|[[Three Cloud Security Best Practices for 2020|https://www.sans.org/cyber-security-intelligence/2019/11/06/three-cloud-security-best-practices-for-2020]]|Best_Practices|
|2019.11.06|//ZScaler//|[[Why You Still Need a Firewall When Deploying Office 365|https://www.zscaler.com/blogs/corporate/why-you-still-need-firewall-when-deploying-office-365]]|O365|
|2019.11.05|//Bitglass//|[[Cloud Adoption 2019: A for Adoption|https://www.bitglass.com/blog/cloud-adoption-2019-a-for-adoption]] ([[[téléchargement|https://pages.bitglass.com/CD-FY19Q4theCloudAdoptionReportof2019_LP.html]])|Report Bitglass|
|2019.11.06|HelpNet Security|[[As more companies deploy cloud apps, they must also implement security tools|https://www.helpnetsecurity.com/2019/11/06/accessing-cloud-data-via-sso/]]|Report Bitglass|
|2019.11.06|//Microsoft//|[[Microsoft Cloud Security solutions provide comprehensive cross-cloud protection|https://www.microsoft.com/security/blog/2019/11/06/microsoft-cloud-security-solutions-provide-comprehensive-cross-cloud-protection/]]|Azure Protection|
|>|>|>|!2019.11.05|
|2019.11.05|Pawel Urbanek|![[How to hide AWS EC2 instances from network scanning bots using IPv6|https://pawelurbanek.com/ec2-scanner-bots-ipv6]]|AWS IPv6 Attacks|
|2019.11.05|DZone|[[How to Remediate Kubernetes Security Vulnerability: CVE-2019-11247|https://dzone.com/articles/how-to-remediate-kubernetes-security-vulnerability-1]]|CVE-2019-11247 Kubernetes|
|2019.11.05|//Sophos//|[[Sophos 2020 Threat Report|https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/sophoslabs-uncut-2020-threat-report.pdf]]|Report Attacks|
|2019.11.08|CIO| → [[Cyber criminals are exploiting android apps and misconfigured cloud platforms for attacks|https://www.cio.co.ke/cyber-criminals-are-exploiting-android-apps-and-misconfigured-cloud-platforms-for-attacks/]]|Report Attacks|
|2019.11.05|//Compare The Cloud//|[[DDoS attacks – Seven effects it has on cloud environments|https://www.comparethecloud.net/articles/ddos-attacks-seven-effects-it-has-on-cloud-environments/]]|Attacks DDoS|
|2019.11.05|//PaloAlto Networks//|[[A Firewall Admin's Introduction to Serverless Security|https://blog.paloaltonetworks.com/2019/11/cloud-serverless-security/]]|Serverless|
|2019.11.05|Computer Weekly|[[Security Think Tank: The cloud needs security by design|https://www.computerweekly.com/opinion/Security-Think-Tank-The-cloud-needs-security-by-design]]|Risks|
|>|>|>|!2019.11.04|
|2019.11.04|Rick's Cloud|[[2019 State of the Cloud in SMBs|https://rickscloud.com/2019-state-of-the-cloud-in-smbs/]]|Report|
|2019.11.04|Bleeping Computer|[[Office 365 to Prevent Malicious Docs From Infecting Windows|https://www.bleepingcomputer.com/news/microsoft/office-365-to-prevent-malicious-docs-from-infecting-windows/]]|O365 Prevention|
|2019.11.04|Container Journal|[[Persistent Data Storage Integral for Containers|https://containerjournal.com/topics/container-networking/persistent-data-storage-integral-for-containers/]]|Containers Storage|
|2019.11.04|HelpNet Security|[[Organizations fail to maximize use of Microsoft 365 security features|https://www.helpnetsecurity.com/2019/11/04/microsoft-365-security-features/]]|Survey SoftwareONE|
|2019.11.04|Christophe Parisel|[[How AWS and Azure are shaping the future of microservices|https://www.linkedin.com/pulse/how-aws-azure-shaping-future-microservices-christophe-parisel/]]|MicroServices|
|2019.11.04|//Microsoft//|[[Microsoft announces new innovations in security, compliance, and identity at Ignite|https://www.microsoft.com/security/blog/2019/11/04/microsoft-announces-new-innovations-in-security-compliance-and-identity-at-ignite/]]|Azure Tools|
|2019.11.04|Security Week| → [[Microsoft Unveils New Security Tools for Azure|https://www.securityweek.com/microsoft-unveils-new-security-tools-azure]]|Azure Tools|
|2019.11.04|Bleeping Computer| → [[Microsoft 365 Helps Improve Orgs' Security and Compliance Posture|https://www.bleepingcomputer.com/news/microsoft/microsoft-365-helps-improve-orgs-security-and-compliance-posture/]]|Azure Tools|
|2019.11.04|Bleeping Computer| → [[Office 365 Breach Detection Capabilities Now in Public Preview|https://www.bleepingcomputer.com/news/microsoft/office-365-breach-detection-capabilities-now-in-public-preview/]]|Azure Tools|
|2019.11.04|Bleeping Computer| → [[Microsoft 365 Now Helps Find and Review Insider Security Threats|https://www.bleepingcomputer.com/news/microsoft/microsoft-365-now-helps-find-and-review-insider-security-threats/ ]]|Azure Tools|
|2019.11.04|Venture Beat| → [[Microsoft announces security, identity, management, and compliance updates across Azure and Office|https://venturebeat.com/2019/11/04/microsoft-announces-security-identity-management-and-compliance-updates-across-azure-and-office/]]|Azure Tools|
|2019.11.04|Computer Weekly|[[Security Think Tank: Secure the cloud when negotiating contracts|https://www.computerweekly.com/opinion/Security-Think-Tank-Secure-the-cloud-when-negotiating-contracts]]|Misc|
|2019.11.04|Dark Reading|[[To Secure Multicloud Environments, First Acknowledge You Have a Problem|https://www.darkreading.com/cloud/to-secure-multicloud-environments-first-acknowledge-you-have-a-problem/a/d-id/1336219]]|MultiCloud|
|2019.11.04|//Microsoft//|[[What's new in Azure Active Directory at Microsoft Ignite 2019|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/What-s-new-in-Azure-Active-Directory-at-Microsoft-Ignite-2019/ba-p/827831]]|AzureAD|
|2019.11.04|//Spanning//|[[5 Steps to Securing your Office 365 Migration|https://spanning.com/blog/5-steps-securing-your-office-365-migration/]]|O365|
|2019.11.04|//Microsoft//|[[Book of News - Microsoft Ignite 2019|https://news.microsoft.com/wp-content/uploads/prod/sites/563/2019/11/Ignite-2019-Book-of-News.pdf]]|Azure|
|2019.11.04|//Forrester//|[[Predictions 2020: Cloud Computing|https://www.forrester.com/report/Predictions+2020+Cloud+Computing/-/E-RES157593]]|Predictions|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Novembre 2019]]>>
!Communiqué de presse : "//CSA Contributes to Key How-To Guidance Documents for Multi-Party Recognition and Continuous Audit-Based Certification//"
<<<
[>img(200px,auto)[iCSF/EUSEC.jpg]]//Practical guidelines to innovative framework promoting trust in cloud services
BERLIN –– Nov. 7, 2019 – The ''Cloud Security Alliance'' (CSA), the world's leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today announced the availability two guidance documents – "+++*[Implementing Multi-Party Recognition for Cloud Security Certifications]> lien → https://cdn0.scrvt.com/fokus/ccc72dd1f339f01e/440004d502fa/EU-SEC-Guidelines---Implementing-Multi-Party-Recognition-for-Cloud-Security-Certifications---ALL-GUIDES.pdf === and +++*[Implementing Continuous Audit-Based Certification]> lien → https://cdn0.scrvt.com/fokus/2dd3c180ea11ea69/1c925e3b6fb9/EU-SEC-Guidelines---Implementing-Continuous-Audit-Based-Certification.pdf === – designed for cloud stakeholders wishing to improve the business value, efficiency and effectiveness of their approach to cloud security certification schemes.

Since January 2017, CSA has been a key partner in the +++*[European Security Certification Framework (EU-SEC)]> lien → https://www.sec-cert.eu/ ===, a project funded by the European Commission under the H2020 program for research and innovation. The aim of EU-SEC is to create a framework under which existing certification and assurance approaches can co-exist, adding at the same time an additional layer of trust, assurance and transparency by including continuous auditing-based certifications.
"Compliance fatigue and lack of clarity is a tremendous problem in the cloud industry," said Daniele Catteddu, Global CTO at CSA. "The multi-party approach to cloud security certifications is a great way to tackle this as it minimizes the compliance burden for cloud service providers, as well as delivering a competitive advantage to auditors."
"I think this [Framework] is a big step towards managing compliance and providing a common framework to many large, complex and multi-site organizations," said Jatin Sehgal, Global Leader and Managing Partner, EY CertifyPoint.

Based on survey and analysis of the certification and standardization landscape which highlighted a number of issues in the ICT market in Europe, such as lack of trust and transparency, compliance fatigue and assurance gaps, the EU-SEC embarked on an ambitious path to create a framework which would assist cloud stakeholders navigating this complex and confusing field. The intervening years have been dedicated to developing this framework, leveraging the expertise of partners such as CSA.

The publication of the +++*[EU Cybersecurity Act (EUCA)]> lien → https://ec.europa.eu/digital-single-market/en/eu-cybersecurity-act === in June 2019, which shares EU-SEC's objective of increasing trust in ICT services, has reinforced and supported the work of EU-SEC.
The newly published how-to guidance documents bring together that expertise in a practical format for auditors, standard owners, cloud service providers and auditees who are looking to innovate their approach to certification and standardization.

In order to ensure the Framework remains relevant, CSA is inviting cloud stakeholders to complete a +++*[short survey]> lien → https://www.surveymonkey.com/r/EUSEC === on the certification and standardization landscape. The valuable contribution of auditors, standard owners and cloud service providers to this survey will provide CSA with an updated understanding of existing practices and feed into the development of the framework. The survey, which closes Nov. 28, can be found +++*[here]> lien → https://www.surveymonkey.com/r/EUSEC ===.//
<<<
__A noter :__
* Le guide d'implémentation est constitué de 3 parties : une pour les dépositaires du standard, une pour les entités auditrices, et un epour les entités auditées.
* Le sondage, accessible [[ici|https://CloudSecurityAlliance.fr/go/jb7s/]], est ouvert jusqu'au jeudi 28 novembre 2019.

&rArr; Lire [[le communiqué de presse|https://CloudSecurityAlliance.fr/go/jb7p/]] sur le site de la CSA.
!"//Google's Potential Claim to the Throne of Quantum Supremacy: What Does it Mean for Cybersecurity?//"
[>img(150px,auto)[iCSA/JB6BW.jpg]]Article de blog publié le 6 novembre 2019 — Rédigé par Roberta Faux, Shamik Kacker, Bruno Huttner, John Hooks, Ron F. del Rosario et John Young
<<<
//__''A mysterious paper''__
A research paper titled "+++*[Quantum Supremacy Using a Programmable Superconducting Processor]> lien → https://www.nature.com/articles/s41586-019-1666-5 ===" briefly appeared last September 21, 2019 on NASA's Technical Report Server (TRS), but was later removed.
In the paper, researchers from +++*[Google AI Quantum Labs]> lien → https://ai.google/research/teams/applied-science/quantum/ === claimed supremacy in quantum computing by successfully running a series of ground-breaking experiments utilizing a processor with programmable superconducting qubits and completing an experiment within 200 seconds that normally would take a modern, state-of-the-art supercomputer approximately 10,000 years to complete.
Various research and scientific community websites were able to obtain +++*[a copy of the document prior to its removal]> lien → https://www.inverse.com/article/59507-full-quantum-supremacy-paper ===. Therefore, this document has been the subject of much debate, scrutiny and speculation for the past few weeks. It is very likely that the paper is currently under peer review and shall be available soon.
Whether it was a PR stunt to attract interest (it worked!) or an honest mistake, it is now official: Google published on October 23, the results of their quantum supremacy experiment in the Nature article Quantum supremacy using +++*[a programmable superconducting processor]> lien → https://www.nature.com/articles/s41586-019-1666-5 ===.

__''What is Quantum Supremacy?''__
Coined by John Preskill back in 2012, "Quantum Supremacy" describes the point where quantum computers can do things that classical computers can't, regardless of whether those tasks are useful. John is a Theoretical Physicist and Director of The Institute for Quantum Information and Matter (IQIM) at Caltech.
In the paper, Google AI Quantum Labs researchers claimed they were able to achieve this status in quantum computing through their experiments utilizing a physical quantum processor with sufficiently low error rates:
"We have performed random quantum circuit sampling in polynomial time with a physically realized quantum processor (with sufficiently low error rates), yet no efficient method is known to exist for classical computing machinery. As a result of these developments, quantum computing is transitioning from a research topic to a technology that unlocks new computational capabilities. We are only one creative algorithm away from valuable near-term applications."
Note however, that some naysayers doubt this claim. The mathematician, Gil Kalai fully expects that "quantum supremacy cannot be achieved at all". While accepting the importance of this work, Kalai argues that Google made a crucial mistake in their supremacy claims. IBM, who is also one of the main contenders in the quantum race and has built its own 53-qubit machine, was not slow to react as well. The IBM team published a counter-argument to Google's estimates, arguing that the calculation could be simulated in just 2.5 days on available supercomputers, not the 10,00 years which Google reported. Whether Google has demonstrated "quantum supremacy" or is merely on the verge of "quantum supremacy," this feat should be noted as a milestone.

__''Potential impact on current cryptographic systems''__
According to John Preskill, the experiment is a sort of "demonstration" at this early stage that Google researchers understand their quantum computing hardware and the next big step is to look for more practical applications in general computing.
Researchers also stated that the next focus should be on engineering quantum error correction technology in order to tackle problems with immediate implications to current computing paradigms such as Shor's Algorithm.
Published back in 1995 by AT&T Labs Researcher Peter Shor in his paper "Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer", the so-called Shor's Algorithm is a quantum algorithm that causes an exponential speed-up when solving factoring, discrete logarithm (DLP), and elliptic curve discrete logarithm (ECDLP) problems. Modern public key cryptography, which underpins secure communication and e-commerce on the internet, relies on the difficulty of solving these problems with our current classical computing paradigm. Therefore, a fully-realized quantum computer running Shor's algorithm will easily circumvent our current cryptographic infrastructure. Note that Shor's algorithm is not the only quantum algorithm attacking cybersecurity. Grover's algorithms can compromise our symmetric cryptography (e.g. AES). However, as it only results in a quadratic speed-up, increasing the AES key size can provide adequate resistance against Grover's quantum attack.
Does it mean that Google's experiment means doom for cybersecurity today? Not quite. As expressed above, the first caveat is about quantum error correction technology. A brief technical aside is required here to explain what we are writing about.
Today, all quantum processors utilize physical qubits, which can be in a coherent superposition of zero and one. With this type of qubits, every operation introduces some error, basically reducing the quality of the qubit. This limits the total number of operations, which can be performed before you "lose" your qubits, or decohere. In order to go further and perform longer computations, we need to move to logical qubits. A logical qubit is built from a large number of physical qubits, which protect it and enable error-free computations. This is the field of quantum error correction technology. Note that a classical computer, which runs on classical bits (zeros and ones), runs naturally on logical bits. In order to run Shor's algorithm, a quantum computer has to implement logical qubits. Now back to our development...
Google's system is using physical qubits, with a sufficiently low error rate. This was apparently enough to demonstrate quantum supremacy. However, it will probably be a good number of years before a quantum computer can run long enough computations with logical qubits. The current estimates are between 5 to +10 years.
The second caveat is that, although current cybersecurity infrastructure relies on potentially unsafe cryptographic protocols, new developments are currently underway to address this issue. This is the task of quantum-safe cryptography.

__''Can we counter the quantum threat?''__
The fact that we still have a few years before quantum supremacy transforms into a real threat to cybersecurity should not lure us into a false sense of security. We can already record data today and decrypt it once a powerful enough quantum computer is available. Information exchanged today, which may still have value in several years, is already at threat. Even adapting our infrastructure to the threat will take several years.
[>img(200px,auto)[iCSA_/PEFTQCCST.png]]According to the October 2019 research "Quantum Threat Timeline" conducted by the Global Risk Institute, the transition to quantum-safe cryptography is a challenge itself, as it requires the development and deployment of hardware and software solutions, the establishment of standards, the migration of legacy systems, and more."
Fortunately, things are already moving. Post-Quantum or Quantum-safe algorithms are actively being developed to specifically address this looming threat of quantum computing in the security of modern communication systems. The NIST in the USA has launched a competition, wherein groups of researchers around the world propose post-quantum algorithms for different cryptographic purposes. The goal is to converge to a few of them, which will become standards between 2022 and 2024.
In an interesting twist, new solutions, such as Quantum Random Number Generators and Quantum Key Distribution, based on the same quantum effects, can already be deployed today to offer quantum-safe communications.
Within the Cloud Security Alliance (CSA), the Quantum-Safe Security (QSS) working group is a forum where companies and academic institutions meet to discuss these issues, and suggest solutions. It has written a number of white papers, which address most of the above topics in a non-technical format. The latest report discusses how to prepare enterprises for the quantum threat.//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jb6q/]] sur le blog de la CSA.
!"//CMMC – the New Protocol Droid for DoD Compliance//"
[>img(150px,auto)[iCSA/JB6BC.png]]Article de blog publié le 6 novembre 2019 — Rédigé par Doug Barbin, Cybersecurity Practice Leader chez Schellman & Company, LLC
<<<
//A long time ago in a galaxy exactly ours…There was 800-171.
For some time, the US Department of Defense has been working to revise its funding procurement procedures referred to as the Defense Acquisition Regulation Supplement, or DFARS.Most important among all the details are the included requirements in the regulations (under 252.204-7012), which mandate that defense contractors meet the NIST special publication (SP) 800-171 standard that deals with Controlled [but] Unclassified Information (CUI).

__Episode I – The Mandated Requirement__
NIST 800-171, unlike its broader cousin NIST 800-53, was written for non-government entries such as government contractors and service providers.With that being said, though NIST 800-171 is required for contractors, the DFARS regulation also necessitates the more comprehensive FedRAMP authorization for cloud service providers.

__Episode II – The Rise of CMMC__
The means to communicate NIST 800-171 compliance has always been inconsistent, with many service providers performing self-attestation, but earlier this year, the DoD made a presentation on a new model based on new revisions to the requirement. This new model includes a "certification" framework, and contractors and vendors who were once able to self-attest will now need third-party validation in 2020.
This proposed framework is called the +++*[Cybersecurity Maturity Model Certification, or CMMC]> lien → https://www.acq.osd.mil/cmmc/ ===.
The model, now on version 0.4, was most recently updated on August 30, 2019. For more details, see the  +++*[August 30, 2019 briefing document]> lien → https://www.acq.osd.mil/cmmc/docs/cmmc-overview-brief-30aug19.pdf ===, as well as the latest  +++*[Criteria v 0.4 – August 30, 2019]> lien → https://www.acq.osd.mil/cmmc/docs/cmmc-draft-model-30aug19.pdf ===.
In terms of requirements, v0.4 now includes additional descriptions of levels and practices including:
* 35 practices to achieve level 1 maturity or "Basic Cyber Hygiene"
* 115 additional practices to achieve level 2 maturity or "Intermediate Cyber Hygiene"
* 91 additional practices to achieve level 3 maturity or "Good Cyber Hygiene"
* 95 additional practices to achieve level 4 maturity or "Proactive"
* 34 additional practices to achieve level 5 maturity or "Advanced Progressive"

__Episode III – Oversight Awakens__
Lastly, on October 3rd DoD issued +++*[an RFI]> lien → https://www.fbo.gov/index?s=opportunity&mode=form&id=4a4b539a0e347e540b30b3121916031c&tab=core&_cview=0 === to solicit accreditation bodies for CMMC.Note that this is not for audit firms like Schellman, but for an accreditation body that will oversee and audit the auditors.Within the request for information, the DoD disclosed that the auditors will now be referred to as CMMC 3rd Party Assessment Organizations (C3PAOs).Yes, you heard that correctly, though there's been no word on Artoo Detoo.

__Episode IV – A New Requisite__
To summarize, here is what we know, based on the above data points:
* Version 0.4 further increased the number of required practices for each leader.
* The Undersecretary of Defense is expected to create an accreditation body to authorize C3PAOs.It would not be surprising should it come together similarly to FedRAMP, which requires 3PAOs to be accredited by A2LA.
* To date, there still has been no guidance released on the content or format of CMMC or C3PAO deliverables - everyone remains in a holding pattern there.
* CMMC validation by a third party is expected to be requested in RFIs starting in June of 2020 and in RFPs starting in the fall of 2020.
//[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jb6d/]] sur le blog de la CSA.
!"//CSA Summit at (ISC)² Security Congress 2019//"
[>img(200px,auto)[iCSA/JAR-MCO.jpg]]Le ''CSA Summit'' s'est tenu à Orlando le 27 octobre 2019, dans le cadre du congrès (ISC)².

Les 6 présentations sont maintenant disponibles en téléchargement :
* "''Diversify Defense - Improving Cybersecurity Through Smart Consolidation''" par Jeff Costlow, ExtraHop
* "''The Next Evolution of Cloud Based Attacks and How to Prevent It''" par Brian Johnson, DivvyCloud
* "''Tell Me a Story – The Art of Explaining Risks''" par Christine Vanderpool, Florida Crystals
* "''Rethinking the Traditional Cloud Vendor Assessment Model: Proactive vs Reactive Vendor Security''" par Michael Odenwald, Whistic
* "''Security Leaders as Change Leaders''" par Marnie Wilking, Wayfair
* "''Eight Ball For The Win: Key Cloud and Cybersecurity Trends for 2020''" par Jim Reavis, Cloud Security Alliance[>img(100px,auto)[iCSA/JARCCAK.png]]
** Jim Reavis a notamment annoncé le ''CCAK'' (Certificate of Cloud Auditing Knowledge) pour 2020.

Les présentations peuvent être téléchargées individuellement ou en une seule fois.
Lien de téléchargement du paquet complet &rArr; ''[[CloudSecurityAlliance.fr/go/jb4p/|https://CloudSecurityAlliance.fr/go/jb4p/]]
!1 - Les nouveautés CSA de la semaine du 28 octobre au 3 novembre 2019
* Publication : Exigences pour les organismes procédant à l'audit et à la certification STAR +++*[»]> <<tiddler [[Publication : Exigences pour les organismes procédant à l'audit et à la certification STAR]]>>=== [>img[iCSF/cloud-security-alliance-fr.png]]
* Actu : Utilisation de SDP en anti-DDoS +++*[»]> <<tiddler [[2019.10.28 - Actu : Utilisation de SDP en anti-DDoS]]>>=== 
* Publication : Utilisation de SDP en anti-DDoS +++*[»]> <<tiddler [[2019.10.28 - Publication : Utilisation de SDP en anti-DDoS]]>>=== 
* Actu : Appel à commentaires, documents 'CloudAbuse Working Group Charter'+++*[»]> <<tiddler [[2019.10.29 - Actu : Appel à commentaires, document 'CloudAbuse Working Group Charter']]>>=== et 'Privacy Level Agreement Working Group Charter' +++*[»]> <<tiddler [[2019.10.29 - Actu : Appel à commentaires, document 'Privacy Level Agreement Working Group Charter']]>>=== 
!2 - Veille Web
La +++*[Veille Web]> <<tiddler [[2019.11.03 - Veille Hebdomadaire]]>>=== avec plus de 70 liens :
* __''À lire'' :__ Article "Cloud Storage Acquisition from Endpoint Devices" sur le site du SANS +++*[»]>
|2019.10.30|SANS|![[Cloud Storage Acquisition from Endpoint Devices|https://digital-forensics.sans.org/blog/2019/10/30/cloud-storage-endpoint-devices]]|Forensics Storage|
=== 
* Phishing Office 365 : plusieurs cas récents
* Retours d'expérience sur des pannes ou des incidents : Little "Chubby" (GCP), Capital One
* Rapports et sondages : Rick's Cloud, Securonix, Sysdig
* Cloud souverain : quelques éléments sur les efforts en France et en Europe
!3 - Conférences et Salons
* Le programme de la ''Cloud & Cyber Security Expo'' des ''27 et 28 novembre'' à Paris est partiellement disponible :
** ''Deuxième'' teaser et inscription gratuite +++*[»]> <<tiddler [[2019.11.01 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (2/3)]]>>=== 
** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== 
* Les inscriptions pour le ''Congrès Européen'' des ''18 au 21 novembre'' à Berlin sont toujours ouverte+++*[»]> <<tiddler [[2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]>>=== 
** Contactez-nous pour avoir une réduction sur votre inscription.+++*[»]> → [img(200px,auto)[iCSF/Email-CSA_FR.png]]=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Novembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.11.01|
|2019.11.01|BetaNews|[[How automation can contribute to cloud security [Q&A]|https://betanews.com/2019/11/01/automation-cloud-security-qa/]]|Automation|
|2019.11.01|CBR Online|[[Google Cloud's Little "Chubby" Outage|https://www.cbronline.com/news/google-cloud-outage-chubby]]|GCP Outage Lessons_Learnt|
|2019.11.01|ZDnet|[[Europe's cloud computing plan won't do much to scare the US giants|https://www.zdnet.com/article/europes-cloud-computing-plan-wont-do-much-to-scare-the-us-giants/]]|Sovereign_Cloud Europe|
|2019.11.01|//Protego//|[[State of Serverless and Security|https://www.protego.io/state-of-serverless-and-security/]] ([[infographie|https://ss-usa.s3.amazonaws.com/c/308465463/media/18915dbcb1e74090390480216989672/infographic%20survey.pdf]])|Survey Serveless|
|2019.11.01|//Fugue//|[[Securing Microsoft Azure Virtual Networks and Network Security Groups|https://www.fugue.co/blog/securing-microsoft-azure-virtual-networks-and-network-security-groups]]|Azure Networking|
|2019.11.01|//CloudCheckr//|[[5 Rules of Multi-Cloud Governance: What AWS, Azure, and Google Cloud Users Need to Know|https://cloudcheckr.com/multi-cloud/multi-cloud-governance/]]|Governance|
|!Octobre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.10.31|
|2019.10.31|SANS|[[EML attachments in O365 - a recipe for phishing|https://isc.sans.edu/forums/diary/EML+attachments+in+O365+a+recipe+for+phishing/25474/]]|O365 Phishing|
|2019.10.31|DZone|[[Demystifying Security on AWS Cloud|https://dzone.com/articles/demystifying-security-on-aws-cloud]]|AWS|
|2019.10.31|SiliconAngle|[[Disaster recovery essential for data protection, and cloud makes it scalable|https://siliconangle.com/2019/10/31/disaster-recovery-essential-for-data-protection-datrium-cloud-scalable-dr-cubeconversations/]]|DRP|
|2019.10.31|//Google//|[[Exploring container security: Use your own keys to protect your data on GKE|https://cloud.google.com/blog/products/containers-kubernetes/exploring-container-security-use-your-own-keys-to-protect-your-data-on-gke]]|GCP Containers|
|2019.10.31|//Google//|[[Admin Insider: These 6 steps can help you address security threats in G Suite|https://cloud.google.com/blog/products/g-suite/admin-insider-these-6-steps-can-help-you-block-security-threats-in-g-suite]]|GCP Protection|
|2019.10.31|//Alibaba//|[[Thoughts on the Development of Secure Container Technology|https://medium.com/@Alibaba_Cloud/thoughts-on-the-development-of-secure-container-technology-8fb30670eea]]|Containers|
|2019.10.31|//Alibaba//|[[Next-Gen Enterprise Security Based on Cloud-Native Technology|https://medium.com/@Alibaba_Cloud/next-gen-enterprise-security-based-on-cloud-native-technology-6a6c28a6011e]]|Misc|
|2019.10.31|//Viruss//|[[3 Tips to Protect Yourself From the Office 365 Phishing Scams|http://www.viruss.eu/virus-news/3-tips-to-protect-yourself-from-the-office-365-phishing-scams-3/]]|O365 Phishing|
|2019.10.31|//Synology//|[[Behold: The 2019 cloud backup myth-buster|https://www.theregister.co.uk/2019/10/31/the_cloud_backup_myth_buster/]]|BackUps|
|2019.10.31|//Alcide//|[[Kubernetes Audit: Making Log Auditing a Viable Practice Again|https://blog.alcide.io/kubernetes-audit-making-log-auditing-a-viable-practice-again]]|Kubernetes Audit Logging|
|2019.10.31|//Caylent//|[[Kubernetes Service Discovery|https://caylent.com/kubernetes-service-discovery]]|Kubernetes Discovery|
|2019.10.31|//Google//|[[How GCP helps you take command of your threat detection|https://cloud.google.com/blog/products/identity-security/how-gcp-helps-you-take-command-of-your-threat-detection]]|GCP Detection|
|2019.10.31|//Armor//|[[Achieving PCI Compliance on AWS Is More Involved Than You Think|https://www.armor.com/blog/aws-pci-compliance/]]|AWS PCI_DSS Compliance|
|2019.10.31|//Lacework//|[[AWS Security Best Practices for 2020 You Need to Implement|https://www.lacework.com/aws-security-best-practices-2020/]]|AWS Best_Practices|
|2019.10.31|//Capsule8//|[[The Curious Case of a Kibana Compromise|https://capsule8.com/blog/the-curious-case-of-a-kibana-compromise/]]|Compromise|
|2019.10.31|//Managed Methods//|[[Top 4 Cloud Security Risks for K-12|https://managedmethods.com/blog/cloud-security-risks-for-k-12/]]|Risks|
|2019.10.31|//Google//|[[How Google adopted BeyondCorp: Part 4 (services)|https://security.googleblog.com/2019/10/how-google-adopted-beyondcorp-part-4.html]] (4/4)|Services|
|>|>|>|!2019.10.30|
|2019.10.30|Solutions Numériques[>img[iCSF/flag_fr.png]]|[[La France et l'Allemagne ont présenté la feuille de route du futur Cloud européen|https://www.solutions-numeriques.com/securite/la-france-et-lallemagne-ont-presente-la-feuille-de-route-du-futur-cloud-europeen/]]|Sovereign_Cloud|
|2019.10.30|SANS|![[Cloud Storage Acquisition from Endpoint Devices|https://digital-forensics.sans.org/blog/2019/10/30/cloud-storage-endpoint-devices]]|Forensics Storage|
|2019.10.30|Down the rabbit Hole|[[Contain(er) Your Security|http://podcast.wh1t3rabbit.net/dtsr-episode-368-container-your-security]] ([[podcast mp3|http://hwcdn.libsyn.com/p/d/a/f/daf7af50cae08cd8/DtSR_Episode_368_-_Container_Your_Security.mp3]])|Containers|
|2019.10.30|APNIC|[[Internet clouds are (also) unpredictable|https://blog.apnic.net/2019/10/30/internet-clouds-are-also-unpredictable/]]|Networking Latency|
|2019.10.30|//McAfee//|[[Office 365 Users Targeted by Voicemail Scam Pages|https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/office-365-users-targeted-by-voicemail-scam-pages/]]|O365 Phishing|
|2019.10.31|Bleeping Computer| → [[New Office 365 Phishing Scams Using Audio Voicemail Recordings|https://www.bleepingcomputer.com/news/security/new-office-365-phishing-scams-using-audio-voicemail-recordings/]]|O365 Phishing|
|2019.10.31|HepNet Security| → [[Office 365 users targeted with fake voicemail alerts in suspected whaling campaign|https://www.helpnetsecurity.com/2019/10/31/office-365-voicemail-phishing/]]|O365 Phishing|
|2019.10.31|//Threatpost//| → [[Fake Voicemail/Office 365 Attack Targets Enterprise Execs|https://threatpost.com/enterprise-big-fish-fake-voicemail-office-365-attack/149730/]]|O365 Phishing|
|2019.10.30|3DS Outscale[>img[iCSF/flag_fr.png]]|![[Le Cloud Act en une infographie par 3DS Outscale|https://www.informatiquenews.fr/le-cloud-act-en-une-infographie-par-eds-outscale-64243]]|CLOUD_Act|
|2019.10.30|//Securonix//|[[More than 1 in 3 Enterprises Say Cloud Apps Are the Most Vulnerable to Insider Threat|https://www.securonix.com/press-release/more-than-1-in-3-enterprises-say-cloud-apps-are-the-most-vulnerable-to-insider-threat/]] ([[2019 Insider Threat Survey Report|https://www.securonix.com/resources/2019-insider-threat-survey-report/]])|Report Securonix|
|2019.10.30|Dark Reading| → [[Security Pros Fear Insider Attacks Stem from Cloud Apps|https://www.darkreading.com/cloud/security-pros-fear-insider-attacks-stem-from-cloud-apps/d/d-id/1336215]]|Report Securonix|
|2019.10.30|//Google//|[[Cloud storage data protection that fits your business|https://cloud.google.com/blog/products/storage-data-transfer/cloud-storage-data-protection-that-fits-your-business]]|GCP Storage|
|2019.10.30|//McAfee//|[[3 Tips to Protect Yourself From the Office 365 Phishing Scams|https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/office-365-phishing/]]|O365 Phishing|
|2019.10.30|//Protego//|[[Cloud Native Application Security - What You Need To Know|https://www.protego.io/what-you-need-to-know-about-cloud-native-security/]]|Cloud_Native|
|2019.10.30|//Microsoft//|[[Tutorial: Configure secure LDAP for an Azure Active Directory Domain Services managed domain|https://docs.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-configure-ldaps]]|AzureAD LDAP|
|>|>|>|!2019.10.29|
|2019.10.28|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[Un projet franco-allemand jette les bases d'un cloud européen|https://www.lemondeinformatique.fr/actualites/lire-un-projet-franco-allemand-jette-les-bases-d-un-cloud-europeen-76933.html]]|Sovereign_Cloud|
|2019.10.28|Informatique News[>img[iCSF/flag_fr.png]]|[[Les licences Microsoft 365 peuvent poser des problèmes de conformité|https://www.informatiquenews.fr/les-licences-microsoft-365-peuvent-poser-des-problemes-de-conformite-64215]]|O365 License|
|2019.11.01|The Register| → [[Microsoft sees sense, will give Office 365 admins veto rights on self-service Power tools|https://www.theregister.co.uk/2019/11/01/microsoft_power_platform_u_turn/]]|O365 License|
|2019.11.01|Informatique News[>img[iCSF/flag_fr.png]]| → [[Microsoft fait marche arrière sur son "Self-Service" pour Power Platform|https://www.informatiquenews.fr/microsoft-fait-marche-arriere-sur-son-self-service-pour-power-platform-64263]]|O365 License|
|2019.10.29|Container Journal|[[Top 10 Container and Kubernetes Security Questions to Ask Your Team|https://containerjournal.com/features/top-10-container-and-kubernetes-security-questions-to-ask-your-team/]]|Containers Kubernetes|
|2019.10.29|DZone|[[Docker Explained – An Introductory Guide To Docker|https://dzone.com/articles/docker-explained-an-introductory-guide-to-docker]]|Docker|
|2019.10.29|Dark Reading|[[Why Cloud-Native Applications Need Cloud-Native Security|https://www.darkreading.com/cloud/why-cloud-native-applications-need-cloud-native-security/a/d-id/1336187]]|Cloud_Native|
|2019.10.29|Euractiv|[[European cloud network to start in late 2020|https://www.euractiv.com/section/digital/news/european-cloud-network-to-start-in-late-2020/]]|Sovereign_Cloud Europe|
|2019.10.29|Synergy Research|[[Amazon, Microsoft, Google and Alibaba Strengthen their Grip on the Public Cloud Market|https://www.srgresearch.com/articles/amazon-microsoft-google-and-alibaba-strengthen-their-grip-public-cloud-market]]|Report|
|2019.10.30|Informatique News[>img[iCSF/flag_fr.png]]| → [[Cloud : quatre leaders sur un marché concentré|https://www.informatiquenews.fr/cloud-quatre-leaders-sur-un-marche-concentre-64230]]|Report|
|2019.10.29|TMCnet|[[Capital One AWS Breach is a Headache for Consumers, the Bank and now Amazon|https://blog.tmcnet.com/blog/rich-tehrani/security/capital-one-aws-breach-is-a-headache-for-consumers-the-bank-and-now-amazon.html]]|CapitalOne Outage Lessons_Learnt|
|2019.10.29|//Sysdig//|[[Sysdig 2019 Container Usage Report: New Kubernetes and security insights|https://sysdig.com/blog/sysdig-2019-container-usage-report/]]|Report Containers Kubernetes|
|2019.10.29|Container Journal| → [[Sysdig Report Shines Light on Container Usage Patterns|https://containerjournal.com/topics/container-ecosystems/sysdig-report-shines-light-on-container-usage-patterns/]]|Report Containers Kubernetes|
|2019.10.29|//Anchore//|[[Benefits of Static Image Inspection and Policy Enforcement|https://anchore.com/benefits-static-image-inspection/]]|Containers|
|2019.10.29|//AlienVault//|[[Was the largest breach in history a misconfiguration problem?|https://www.alienvault.com/blogs/security-essentials/was-the-largest-breach-in-history-a-misconfiguration-problem]]|Misconfigurations|
|2019.10.29|//Jump Cloud//|[[Azure MFA|https://jumpcloud.com/blog/azure-mfa/]]|Azure Authentication|
|2019.10.29|//Alert Logic//|[[Streamline Cybersecurity for Cloud Applications and Data on Azure|https://blog.alertlogic.com/streamline-cybersecurity-for-cloud-applications-and-data-on-azure/]]|Azure|
|>|>|>|!2019.10.28|
|2019.10.28|Silicon.fr[>img[iCSF/flag_fr.png]]|[[DevOps : une autre gestion du risque… et de la productivité|https://www.silicon.fr/devops-risque-productivite-311933.html]]|DevOps Risks|
|2019.10.28|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Cloud : avec JEDI, Microsoft devient le fournisseur clé du Pentagone|https://www.silicon.fr/jedi-cloud-microsoft-fournisseur-cle-pentagone-311937.html]]|Government JEDI|
|2019.10.28|Federal News Network| → [[JEDI to Microsoft? It ain't over yet|https://federalnewsnetwork.com/tom-temin-commentary/2019/10/jedi-to-microsoft-it-aint-over-yet/]]|Government JEDI|
|2019.10.28|Redmond Channel Partner| → [[How Permanent Is Microsoft's Shocking JEDI Win?|https://rcpmag.com/blogs/scott-bekker/2019/10/microsoft-shocking-jedi-win.aspx]]|Government JEDI|
|2019.10.28|Direction Informatique[>img[iCSF/flag_fr.png]]|[[Avons-nous raison d'être frileux envers le cloud?|https://www.directioninformatique.com/avons-nous-raison-detre-frileux-envers-le-cloud/80472]]|Misc|
|2019.10.28|Rick's Cloud|[[2019 State of the Cloud in the Enterprise|https://rickscloud.com/2019-state-of-the-cloud-in-the-enterprise/]]|Report|
|2019.10.28|VMblog|[[Cloud-Native DevSecOps: How to Secure Your Cloud|https://vmblog.com/archive/2019/10/28/cloud-native-devsecops-how-to-secure-your-cloud.aspx]]|SecDevOps|
|2019.10.28|The Register|[[Amazon is saying nothing about the DDoS attack that took down AWS, but others are|https://www.theregister.co.uk/2019/10/28/amazon_ddos_attack/]]|AWS Outage Aftermath|
|2019.10.28|HelpNet Security|[[DevOps firewall: How pre-configuring your cloud deployment can ensure compliance|https://www.helpnetsecurity.com/2019/10/28/devops-firewall/]]|DevSecOps|
|2019.10.28|Bank Info Security|[[Two Data Leaks Expose Millions of Records|https://www.bankinfosecurity.com/two-data-leaks-expose-millions-records-a-13299]]|Data_Leaks|
|2019.10.28|Jordan Potti|[[Offensive Cloud Distribution|https://github.com/jordanpotti/OffensiveCloudDistribution]] (to distribute large security scans across numerous cloud instances)|[[Tools|Outils-GitHub]]|
|2019.10.28|Sarah Gray|[[Security Best Practices - AWS Virtual Workshop|https://www.youtube.com/watch?v=mNUFa6wGEEk]] (vidéo de 1h30)|AWS Workshop|
|2019.10.28|//AWS//[>img[iCSF/flag_fr.png]]|[[Annonce de l'analyse d'image pour Amazon ECR|https://aws.amazon.com/fr/about-aws/whats-new/2019/10/announcing-image-scanning-for-amazon-ecr/]]|AWS Images|
|2019.10.28|Catchpoint|[[Four Ways to Mitigate the Impact of DNS Attacks|https://blog.catchpoint.com/2019/10/28/four-ways-to-mitigate-the-impact-of-dns-attacks/]]|AWS DDoS Outage|
|2019.10.28|//Microsoft//|[[Customize networking for DR drills: Azure Site Recovery|https://azure.microsoft.com/en-us/blog/customize-networking-for-dr-drills-azure-site-recovery/]]|Azure DRP|
|2019.10.28|//Microsoft//|[[IoT security will set innovation free: Azure Sphere general availability scheduled for February 2020|https://www.microsoft.com/security/blog/2019/10/28/iot-innovation-azure-sphere-general-availability-february-2020/]]|Azure_Sphere IoT|
|2019.10.28|//Zscaler//|[[Rethinking Office 365 Security and Networking Infrastructure|https://www.cbronline.com/opinion/office-365-networking-zscaler]]|O365 Architecture|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Novembre 2019]]>>
[>img(200px,auto)[iCSF/CCSEP2019.png]]Pour s'inscrire à la ''Cloud & Cyber Security Expo'' et disposer une deuxième aperçu du programme des conférences gratuites :

Suivez le lien → ''[[CloudSecurityAlliance.fr/go/jb1r|https://CloudSecurityAlliance.fr/go/jb1r]]''

[img(auto,60px)[iCSF/CCSA19h.jpg][https://CloudSecurityAlliance.fr/go/jb1r]]
!"//Cloud Security Alliance Health Information Management Working Group Co-Chair Dr. Jim Angle to Present at HIMSS//"
^^//Dr. Jim Angle, manager of Network Security – Vulnerability Management at Trinity Health and co-chair of CSA's Health Information Management Working Group, will be presenting "''Managing the Risk for Medical Devices Connected to the Cloud''" at the +++*[HIMSS Global Health Conference & Exhibition]> https://www.himssconference.org/ === (Orlando) on March 11 at 2:30 p.m. In his talk, Dr. Angle will share some of his key insights that laid the groundwork for the white paper of the same name by CSA's Health Information Management (HIM) Working Group, sharing with attendees how to apply the IoT Security Controls Framework to highly sensitive medical systems that support critical services.//
&rArr; Lire le [[communiqué de presse|https://cloudsecurityalliance.org/press-releases/2019/11/20/cloud-security-alliance-health-information-management-working-group-co-chair-dr-jim-angle-to-present-at-himss/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//The Four Pillars of CASB: Threat Protection//"
[>img(100px,auto)[iCSA/JBIBT.png]]^^Article publié le 18 novembre sur le blog de la CSA, et après l'avoir été il y a plus de 2 mois sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://cloudsecurityalliance.org/blog/2019/11/18/the-four-pillars-of-casb-threat-protection/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.bitglass.com/blog/four-pillars-casb-threat-protection]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Digital Transformation, Cybersecurity, Cloud Apps, and Cloud Security//"
[>img(100px,auto)[iCSA/JBIBD.jpg]]^^Article publié le 18 novembre sur le blog de la CSA, et après l'avoir été il y a plus de 2 mois sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://cloudsecurityalliance.org/blog/2019/11/21/digital-transformation-cybersecurity-cloud-apps-and-cloud-security/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.bitglass.com/blog/digital-transformation-cybersecurity-cloud-apps-cloud-security]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Traduction en japonais de 2 documents du CSA//"
^^Traductions publiées le 18 novembre 2019 :[>img(100px,auto)[iCSA/J86PT.jpg]][>img(100px,auto)[iCSA/J14PG.png]]
* "Guideline on Effectively Managing Security Service in the Cloud"
** &rArr; Lien de [[téléchargement|https://cloudsecurityalliance.org/artifacts/guideline-on-effectively-managing-security-service-in-the-cloud-japanese-translation/]]
* "Top Threats to Cloud Computing: Egregious Eleven"
** &rArr; Lien de [[téléchargement|https://cloudsecurityalliance.org/artifacts/top-threats-to-cloud-computing-egregious-eleven-japanese-translation/]]
^^
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//CSA Announces Advanced Cloud Security Practitioner Training, a Highly Technical Hands-on Course for Technical Security Professionals//"
[>img(100px,auto)[iCSA/J73CCSK.png]]^^Annonce du 4 novembre pour une formation "Advanced Cloud Security Practitioner Training" les 10 et 11 décembre 2019 à Kansas City, Missouri.
Le formateur sera ''[[Rich Mogull|https://securosis.com/about/team]]'', qui est non seulement très compétent, mais aussi très pédagogue.
&rArr; Lire [[l'annonce|https://CloudSecurityAlliance.fr/go/jb4a/]] sur le site de la ''Cloud Security Alliance''
&rArr; Pour les [[détails et s'inscrire|https://CloudSecurityAlliance.fr/go/jb4i/]]^^
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//3 Technical Benefits of Service Mesh, and Security Best Practices//"
[>img(100px,auto)[iCSA/JB4B3.jpg]]^^Bien que publié le 4 novembre 2019 sur le blog de la CSA, cet article l'a déjà été il y a plus d'un mois, le 26 septembre 2019 sur le site de la société Portshift.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/jb4z/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/jb4x/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201910>>
<<tiddler fAll2Tabs10 with: VeilleM","_201910>>
|!Octobre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|Aucune alerte pour le moment|
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Octobre 2019]]>>
<<tiddler fAll2LiTabs with: NewsL","201910>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Octobre 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Octobre 2019]]>><<tiddler fAll2LiTabs with: Actu","201910>>
<<tiddler fAll2LiTabs with: Blog","201910>>
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Octobre 2019]]>>
<<tiddler fAll2LiTabs with: Publ","201910>>
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Octobre 2019]]>>
!CloudAbuse Working Group Charter
Charte du groupe de travail "Cloud Abuse".[>img(100px,auto)[iCSA/CSAdoc.png]]
La date limite pour transmettre les commentaires est le 29 novembre 2019.
<<<
//The mission of the CloudAbuse working group is to promote operational security and aid in the timely sharing of indicators of abuse across all the member's services.
This mission is conducted through private information sharing within a community of trusted representatives of each member organization.//
<<<
* Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/jatc|https://cloudsecurityalliance.fr/go/jatc/]]''
!Privacy Level Agreement Working Group Charter
Charte du groupe de travail "Open Certification Framework" (OCF)[>img(100px,auto)[iCSA/CSAdoc.png]]
La date limite pour transmettre les commentaires est le 29 novembre 2019.
<<<
//The Cloud Security Alliance would like to invite you to review and comment on the updated Privacy Level Agreement Working Group Charter.
The Privacy Level Agreement (PLA) Working Group was originally established in 2011 with the objective to define good practices and tools to help both CSPs and cloud users in their journey toward the compliance with relevant European Union privacy legislations.
The draft CSA Code of Conduct and Certification are currently under the revision of the relevant Data Protection Authorities.
The goal of CSA is, clearly to obtain the approval of both of them by the European Data Protection Board.
The current version of the PLA CoP (V3.2) doesn't thought cover the requirements of the GDPR Art.46 on international data transfer.
Given the importance of the topic in the cloud market, the CSA has decided to take action and revise the current versions of its CoC and Certification so to be able to use them as tools for international data transfer.
Moreover, in its mission to support both CSPs and customers to overcome their cloud security and privacy challenges, the CSA has also decided to initiate an analysis of other relevant Privacy and Data Protection regulations applicable to the cloud market and define, on the basis of the results already achieved, new tools and best practices for global privacy compliance.
In summary, the extension of the scope of existing CSA's best practice and tools for GDPR compliance to international data transfer and global privacy compliance, would be the main goals of the new PLA WG.
This is your opportunity to provide feedback and identify any critical areas that we might miss in our working group's focus.
The open review and comments period starts today and ends on November 29, 2019.//
<<<
* Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/jatp|https://cloudsecurityalliance.fr/go/jatp/]]''
!Document "//Requirements for Bodies Providing STAR Certification//"
[>img(200px,auto)[iCSA/JATPR.png]]Publication de ce qui semble être un document de travail (avec quelques erreurs mineures) qui s'inspire de l'ISO ISO/IEC 27006:2015 qui porte sur les exigences pour les organismes procédant à l'audit et à la certification des systèmes de management de la sécurité de l'information.
__Extraits :__
<<<
//1 - General
* 1.1 - This document outlines how to conduct a STAR certification assessment to the Cloud Controls Matrix (CCM) as part of an ISO/IEC 27001 assessment.
* 1.2 - The controls set out in the CCM can be considered additional
//[...]//
4 - Requirements on a certification body
* 4.1 - A certification body must be a CSA Corporate Member in good standing
* 4.2 - A certification body conducting CCM assessments shall be ISO/IEC 27006 accredited by an IAF member accreditation body for delivery of ISO/IEC 27001 assessments.
* 4.3 - A certification body shall comply with all the requirements of ISO/IEC 27006 as well as this documents requirements when conducting a CCM assessment.
//[...]//
5 Competency requirements
* 5.1 - All assessors must be able to present evidence of passing an accredited lead auditor
course for ISO/IEC 27001 or be a qualified and experienced ISO/IEC 27001 assessor
for an IAF member accredited ISO/IEC 27001 certification body.
//[...]//
9 - Audit and Certification
9.1 - An assessment cycle will follow the assessment cycle for ISO/IEC 27001.
//[...]
<<<
//&rArr; télécharger le ''[[document|https://CloudSecurityAlliance.fr/go/jasr/]]
!Article "//Cloud Security Alliance Releases Anti-DDoS: Software-Defined Perimeter As a DDoS Prevention Mechanism//"
[>img(200px,auto)[iCSA/JASPS.png]]
<<<
//Document examines the operationalization of Software-Defined Perimeter as prevention mechanism against three well-known types of Distributed Denial of Service attacks

ORLANDO – (ISC)2 Security Congress – Oct. 28, 2019 – The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today released new research on Anti-DDoS: Software-Defined Perimeter as a DDos Prevention Mechanism. Produced by CSA's Software-Defined Working (SDP) Group, this paper sheds light on the use of a SDP as a tool to prevent Distributed Denial-of-Service (DDoS) attacks. It demonstrates the efficiency and effectiveness of a SDP against several well-known attacks including HTTP Flood, TCP SYN, and UDP Reflection.

The document focuses on protecting private services, such as private business applications, employee or customer portals, and email servers, which are well-suited to being protected from DDoS attacks by a Software-Defined Perimeter. Utilizing the Seven Layer OSI Model, various scenarios are laid out based on where the aforementioned attacks may be targeted (i.e. applications, transportation, and networks), which security professionals can use as guides for securing their own enterprise systems.

"Denial of Service attacks are - and continue to be - a problem. With the adoption of cloud services, the threat of network attacks against application infrastructure increases, since traditional perimeter-defense techniques cannot adequately protect servers," said Juanita Koilpillai, co-chair, CSA Software-Defined Perimeter Working Group, and CEO and President of Waverley Labs. "This document, the latest from the SDP Working Group, was created to aid those responsible for the evaluation, design, deployment, or operation of DDoS prevention solutions within their enterprise."

Typically performed against public-facing services running on the internet, such as web servers and DNS servers, DDoS attacks attempt to overwhelm a target and prevent it from delivering its services to legitimate users. SDPs are resilient against these types of attacks, however, because they utilize a computationally lightweight mechanism (SPA) to distinguish between authorized and unauthorized users, even from remote systems. Because the vast majority of DDoS traffic is initiated by unauthorized users, SDP gateways can reject it without incurring a heavy computational load on the server.

The Software-Defined Perimeter Working Group was created with the goal of developing a solution to stop network attacks against application infrastructure. Those interested in learning more about the group or participating in future research should visit the Software-Defined Perimeter Working Group page.//
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jasa/]] sur le site de la CSA.
!Document "//Software-Defined Perimeter as a DDoS Prevention Mechanism//"
[>img(200px,auto)[iCSA/JASPS.png]]__Extraits__
<<<
//__''Goals:''__
The primary goal of this document is to increase the awareness and understanding of SDP as a tool to prevent DDoS attacks by demonstrating its efficiency and effectiveness against several wellknown attacks, including HTTP Flood, TCP SYN, and UDP Reflection.//
[...]
//__''SDP as a DDoS Defense Mechanism:''__ 
The techniques described above to detect, divert, filter and analyze are suitable for a large volume of packets associated with DDoS attacks. Many small malformed packets associated with resource depletion DDoS attacks typically bypass these techniques as they are hard to detect. However, these techniques are expensive and more frequently than not filter out good packets. SDPs are architected to allow ONLY good packets through while dropping all bad packets. In general, with SDPs, hosts are hidden, clients coordinate with (typically with multiple) perimeters so that good packets known to SDPs and upstream routers can be informed about bad packets to block. For the purpose of showing how SDPs can be used as a DDoS defense mechanism, we will use the open source reference implementation as an example. In the reference implementation, clients (users on devices) are cryptographically signed into the perimeter.//
[...]
//__''Summary:''__
The goal of this paper is to increase the awareness and understanding of SDP as a tool to prevent DDoS attacks by demonstrating its efficiency and effectiveness against several well- known attacks.
To that end we presented in the Introduction definitions of DDoS and DoS attacks. Then in the next section DDoS Attack Vectors, we presented a table DDoS attack Vectors by OSI and TCP/IP layers.
From this table we selected as our focus three well-known attacks:
# Layer 7 Application - HTTP Flood Attacks
# Layer 4 Transport - SYN "TCP" Flood
# Layer 3 Network - UDP Reflection Attacks
After selecting the vectors and attacks of focus we explained them conceptually in detail. This was followed by a section DDoS Attack Mitigations via Non SDP Defenses where we described non SDP mitigations that are available for use at various OSI layers.
We followed this up with SDP as DDoS Defense Mechanism. Here we first described the sequence of events that are followed to set up and configure SDP as a DDoS defense. Then we enumerated the protections afforded by the setup including
# Invisible services behind a deny-all SDP Gateway;
# Authenticating users on devices prior to opening up the firewall to establish connections;
# Using a dynamic firewall mechanism, to allow or which allows SDP to drop packets as fast as the switches serve them up during a DDoS attack.
Finally, we looked at the following three attacks using SDP as a defense mechanism:
# HTTP Flood Attack & SDP Defense
# TCP SYN Flood Attack & SDP Defense
# UDP Reflection Attack & SDP Defense
//
<<<
__Table des Matières__//
<<<
* Introduction
** DDoS and DoS Attacks Defined
** Goals
** Target Audience
** DDoS Attack Vectors
** DDoS Attack Vectors by OSI and TCP/IP Model Layer
** DDoS Attack Mitigations (via Non SDP Defenses)
* SDP as a DDoS Defense Mechanism
* HTTP Flood Attack & SDP Defense
** Battlefield
** Attack Explained
** Defense Explained
* TCP SYN Flood Attack and SDP Defense
** Battlefield
** Attack Explained
** Defense Explained
* UDP Reflection Attack & SDP Defense
** Battlefield
** Attack Explained
** Defense Explained
* Summary
* Glossary
* Other Reading
* Appendix
** Appendix 1: OSI & TCP/IP Layers & Logical Protocols
** Appendix 2: DDoS Attacks by OSI & TCP/IP Layers
** Appendix 3: DDoS & Other Attack Monitoring Maps
** Appendix 4: DDoS Biggest Attacks
<<<
//&rArr; télécharger le ''[[document|https://CloudSecurityAlliance.fr/go/jasp/]]
!1 - Les nouveautés CSA de la semaine du 21 au 27 octobre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Corporate Contractors and the Requirement for Zero-Trust Network Access''+++*[»]> <<tiddler [[2019.10.21 - Blog : 'Corporate Contractors and the Requirement for Zero-Trust Network Access']]>>=== 
* Actu : Gouvernance du risque et certification européenne au Congrès CSA EMEA en Novembre à Berlin +++*[»]> <<tiddler [[2019.10.24 - Actu : Gouvernance du risque et certification européenne au Congrès CSA EMEA en Novembre à Berlin]]>>=== 
* __''À lire'' :__ ''Modèle MITRE ATT&CK adapté au Cloud''+++*[»]> <<tiddler [[2019.10.25 - Actu : Modèle MITRE ATT&CK adapté au Cloud]]>>=== 
!2 - Veille Web
La +++*[Veille Web]> <<tiddler [[2019.10.27 - Veille Hebdomadaire]]>>=== avec plus de 60 liens :
* Pannes ou attaques : Amazon AWS, Google GCP
* Fuites de données : Adobe Cloud, AutoClerk (fonctionnaires et militaires américains)
* Annonces : attribution du contrat JEDI pour le DoD à ... Microsoft (pour le moment)
* Rapports : Skybox Security
* Divers : Docker, Kubernetes, sécurité des containers
!3 - Conférences et Salons
* Le programme de la ''Cloud & Cyber Security Expo'' des ''27 et 28 novembre'' à Paris est partiellement disponible :
** Teaser et inscription gratuite+++*[»]> <<tiddler [[2019.10.11 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (1/3)]]>>=== 
** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== 
* Les inscriptions pour le ''Congrès Européen'' des ''18 au 21 novembre'' à Berlin sont toujours ouverte+++*[»]> <<tiddler [[2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]>>=== 
** Contactez-nous pour avoir une réduction sur votre inscription.+++*[»]> → [img(200px,auto)[iCSF/Email-CSA_FR.png]]=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Octobre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.10.25|
|2019.10.25|Comparitech|[[7 million Adobe Creative Cloud accounts exposed to the public|https://www.comparitech.com/blog/information-security/7-million-adobe-creative-cloud-accounts-exposed-to-the-public/]]|DataLeak Adobe|
|2019.10.25|Bleeping Computer| → [[7.5 Million Records of Adobe Creative Cloud User Data Exposed|https://www.bleepingcomputer.com/news/security/75-million-records-of-adobe-creative-cloud-user-data-exposed/]]|DataLeak Adobe|
|2019.10.25|BetaNews| → [[Adobe exposed personal data of 7.5 million Creative Cloud users in unsecured database|https://betanews.com/2019/10/26/adobe-creative-cloud-data-leak/]]|DataLeak Adobe|
|2019.10.28|Security Week| → [[Adobe Exposed Creative Cloud Customer Information|https://www.securityweek.com/adobe-exposed-creative-cloud-customer-information]]|DataLeak Adobe|
|2019.10.25|The Register|[[You're flowing it wrong: Bad network route between Microsoft, Apple blamed for Azure, O365 MFA outage|https://www.theregister.co.uk/2019/10/25/microsoft_outage_explainer/]]|Outage O365|
|2019.10.25|DoD|!JEDI Cloud : [[Contracts For Oct. 25, 2019|https://www.defense.gov/Newsroom/Contracts/Contract/Article/1999639/]]|Government JEDI|
|2019.10.25|Silicon Angle| → [[In a big surprise, Pentagon grants Microsoft $10B JEDI cloud contract over Amazon|https://siliconangle.com/2019/10/25/surprise-move-pentagon-grants-microsoft-jedi-cloud-contract-amazon/]]|Government JEDI|
|2019.10.25|GeekWire| → [[Amazon 'surprised' after Pentagon awards coveted $10 billion JEDI cloud contract to rival Microsoft|https://www.geekwire.com/2019/microsoft-awarded-pentagons-10b-jedi-cloud-contract-huge-win-rival-amazon/]]|Government JEDI|
|2019.10.25|Federal News Network| → [[Microsoft wins DoD's controversial JEDI Cloud contract|https://federalnewsnetwork.com/defense-main/2019/10/microsoft-wins-dods-jedi-cloud-contract/]]|Government JEDI|
|2019.10.25|Defense One| → [[Microsoft Wins Massive JEDI Cloud Contract|https://www.defenseone.com/business/2019/10/microsoft-wins-massive-jedi-cloud-contract/160890/]]|Government JEDI|
|2019.10.26|The Register| → [[Pentagon beams down $10bn JEDI contract to Microsoft: Windows giant beats off Bezos|https://www.theregister.co.uk/2019/10/26/microsoft_wins_jedi_deal/]]|Government JEDI|
|2019.10.26|Security Week| → [[Pentagon Awards $10 Billion Cloud Contract to Microsoft, Snubbing Amazon|https://www.securityweek.com/pentagon-awards-10-billion-cloud-contract-microsoft-snubbing-amazon]]|Government JEDI|
|2019.10.27|BetaNews| → [[Microsoft awarded Pentagon's controversial JEDI contract|https://betanews.com/2019/10/27/microsoft-wins-jedi-contract/]]|Government JEDI|
|2019.10.25|DZone|[[Why MQTT Has Become the De-Facto IoT Standard|https://dzone.com/articles/why-mqtt-has-become-the-de-facto-iot-standard]]|MQTT|
|2019.10.25|CIO Dive|[[Senators press AWS on cloud security, call for FTC investigation|https://www.ciodive.com/news/senators-press-aws-on-cloud-security-call-for-ftc-investigation/565751/]]|CapitalOne Outage Lessons_Learnt|
|2019.10.25|//Google//|[[Exploring Container Security: Vulnerability management in open-source Kubernetes|https://cloud.google.com/blog/products/containers-kubernetes/exploring-container-security-vulnerability-management-in-open-source-kubernetes]]|containers Kubernetes Vulnerability|
|2019.10.25|//Lacework//|[[NIST Cybersecurity Framework and Your Cloud|https://www.lacework.com/nist-cybersecurity-framework/]]|NIST|
|2019.10.25|//Threatpost//|[[Is AWS Liable in Capital One Breach?|https://threatpost.com/capital-one-breach-senators-aws-investigation/149567/]]|CapitalOne Lessons_Learnt|
|2019.10.25|//BSSI//|[[Retour sur la Hack.lu – Jour 3|https://blog.bssi.fr/retour-sur-la-hack-lu-jour-3/]]|Containers
|>|>|>|!2019.10.24|
|2019.10.24|Hack.lu|![[Who contains the containers|https://cfp.hack.lu/hacklu19/talk/VJSHEV/]]|Containers|
|2019.10.24|RootShell.be| → [[Hack.lu 2019 Day #3 Wrap-Up|https://blog.rootshell.be/2019/10/24/hack-lu-2019-day-3-wrap-up/]]|Containers|
|2019.10.23|Container Journal|[[Kubernetes Without Scale: Setting up a Personal Cluster, Part 2|https://containerjournal.com/topics/container-ecosystems/kubernetes-without-scale-setting-up-a-personal-cluster-part-2/]] (2/2)|Kubernetes|
|2019.10.24|DZone|[[Kubernetes vs. Docker: Comparing The Two Container Orchestration Giants!|https://dzone.com/articles/kubernetes-vs-docker-comparing-the-two-container-o]]|Orchestration Kubernetes Docker|
|2019.10.24|CSO Online|[[5 cloud security basics and best practices|https://www.csoonline.com/article/3446458/5-cloud-security-basics-and-best-practices.html]]|Best_Practices|
|2019.10.24|//ThreatStack//|[[How to Create a Security Risk Assessment for Containers in 5 Steps|https://www.threatstack.com/blog/create-a-security-risk-assessment-for-containers-in-5-steps]]|Containers Risk_Assessment|
|2019.10.24|//CloudCheckr//|[[7 Ways to Improve Your Cloud Computing Return on Investment|https://cloudcheckr.com/cloud-cost-management/7-ways-to-improve-your-cloud-computing-return-on-investment-roi/]]|AWS|
|2019.10.24|//Containous//|[[13 Criteria for Choosing the Best Ingress Controller for Your Kubernetes Deployment|https://vmblog.com/archive/2019/10/24/13-criteria-for-choosing-the-best-ingress-controller-for-your-kubernetes-deployment.aspx]]|Kubernetes|
|2019.10.24|//Alcide//|[[Pod Security Policy|https://blog.alcide.io/pod-security-policy]]|Security_Policy|
|2019.10.24|//Skybox Security//|[[Cloud Infrastructure Vulnerabilities to Increase 50%, According to Skybox Security Report|https://www.prnewswire.com/news-releases/cloud-infrastructure-vulnerabilities-to-increase-50-according-to-skybox-security-report-300944494.html]] ([[rapport|https://lp.skyboxsecurity.com/WICD-2019-10-Cloud-Threat-Trends-Report_Reg.html]])|Report Skybox|
|2019.10.24|//Skybox Security//| → [[Cloud Trends Report Infographic 2019|https://lp.skyboxsecurity.com/WICD-2019-10-Cloud-Threat-Trends-Infographic_03-Infographic.html]] ([[pdf|https://lp.skyboxsecurity.com/rs/440-MPQ-510/images/Skybox_Cloud_Trends_Infographic.pdf]])|Report Skybox|
|2019.10.28|HelpNet Security| → [[IaaS cloud vulnerabilities expected to increase 50% over 2018 figures|https://www.helpnetsecurity.com/2019/10/28/iaas-cloud-vulnerabilities-2019/]]|Report Skybox|
|2019.10.24|//Google//|![[Advancing customer control in the cloud|https://cloud.google.com/blog/topics/inside-google-cloud/advancing-customer-control-in-the-cloud]]|CLOUD_Act|
|>|>|>|!2019.10.23|
|2019.10.23|DZone|[[Docker Container - Volume and Data Recovery|https://dzone.com/articles/docker-container-volume-mount-and-data-recovery]]|Docker|
|2019.10.23|Container Journal|[[Kubernetes Without Scale: Reasons to Run a Personal Cluster, Part 1|https://containerjournal.com/topics/container-ecosystems/kubernetes-without-scale-reasons-to-run-a-personal-cluster/]] (1/2)|Kubernetes|
|2019.10.23|VMblog|[[Using DRaaS to Mitigate the Damage of Ransomware|https://vmblog.com/archive/2019/09/23/using-draas-to-mitigate-the-damage-of-ransomware.aspx]]|DRaaS Mitigation|
|2019.10.23|Eversheds Sutherland|[[Legal Alert: The CLOUD Act – A cross-border data access agreement rises from the fog|https://us.eversheds-sutherland.com/NewsCommentary/Legal-Alerts/226041/Legal-Alert-The-CLOUD-Act-A-cross-border-data-access-agreement-rises-from-the-fog]]|CLOUD_Act|
|2019.10.23|//Google//|[[Find and fix misconfigurations in your Google Cloud resources|https://cloud.google.com/blog/products/identity-security/find-and-fix-misconfigurations-in-your-google-cloud-resources]] (6/6)|GCP Misconfigurations|
|>|>|>|!2019.10.22|
|2019.10.22|The Register|[[Bezos DDoS'd: Amazon Web Services' DNS systems knackered by hours-long cyber-attack|https://www.theregister.co.uk/2019/10/22/aws_dns_ddos/]]|AWS DDoS Outage|
|2019.10.23|Catchpoint|! → [[AWS Users Blindsided by DDoS Attacks|https://blog.catchpoint.com/2019/10/23/aws-ddos-attacks/]]|AWS DDoS Outage|
|2019.10.23|TechRadar| → [[AWS hit by major DDoS attack|https://www.techradar.com/news/aws-hit-by-major-ddos-attack]]|AWS DDoS Outage|
|2019.10.23|IT Pro| → [[AWS servers hit by sustained DDoS attack|https://www.itpro.co.uk/amazon-web-services-aws/34679/aws-servers-hit-by-sustained-ddos-attack]]|AWS DDoS Outage|
|2019.10.23|CBR Online| → [[AWS Hit by DDoS Attack – Google Cloud Issues Unrelated|https://www.cbronline.com/news/aws-ddos-attack]]|AWS DDoS Outage|
|2019.10.24|Dark Reading| → [[Eight-Hour DDoS Attack Struck AWS Customers|https://www.darkreading.com/cloud/eight-hour-ddos-attack-struck-aws-customers/d/d-id/1336165]]|AWS DDoS Outage|
|2019.10.24|Security Week| → [[DDoS Attack Hits Amazon Web Services|https://www.securityweek.com/ddos-attack-hits-amazon-web-services]]|AWS DDoS Outage|
|2019.10.24|InfoSec Mag| → [[AWS Left Reeling After Eight-Hour DDoS|https://www.infosecurity-magazine.com/news/aws-customers-hit-by-eighthour-ddos/]]|AWS DDoS Outage|
|2019.10.22|Ajay Kumar|[[What is Azure Security Center and its Capabilities?|https://medium.com/@intouchajay/what-is-azure-security-center-and-its-capabilities-cf19edbd6983]]|Azure|
|2019.10.22|//TrendMicro//|![[The Shared Responsibility Model|https://blog.trendmicro.com/the-shared-responsibility-model/]]|Shared_Responsibility|
|2019.10.22|//Sophos//|[[Storing your stuff securely in the cloud|https://nakedsecurity.sophos.com/2019/10/22/storing-your-stuff-securely-in-the-cloud/]]|Misc|
|2019.10.22|//Digital Ocean//|[[Issues with accessing S3/RDS resources inside Droplets across all regions|https://status.digitalocean.com/incidents/1z3kmlvz69v6]]|Outage|
|2019.10.22|//Google//|[[Google Cloud Networking Incident #19020|https://status.cloud.google.com//incident/cloud-networking/19020]]|Outage GCP|
|2019.10.22|//ExtraHop//|[[4 Common Cloud Misconfigurations & What To Do About Them|https://www.extrahop.com/company/blog/2019/4-common-cloud-misconfigurations-and-what-to-do-about-them/]]|Misconfigurations|
|2019.10.22|//Tripwire//|[[Guide to Container Security - Everything You Need to Know|https://www.tripwire.com/state-of-security/devops/guide-container-security/]]|Containers Best_Practices|
|2019.10.22|//Microsoft//|[[Users can now check their sign-in history for unusual activity|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Users-can-now-check-their-sign-in-history-for-unusual-activity/ba-p/916066]]|AzureAD|
|2019.10.22|Security Week|[[New Azure AD Feature Detects Unauthorized Access Attempts|https://www.securityweek.com/new-azure-ad-feature-detects-unauthorized-access-attempts]]|AzureAD|
|2019.10.22|//Security Discovery//|[[Religious Website and Software Provider Leaks Customer and Credit Card Data for Many Months|https://securitydiscovery.com/cloversites/]]|DataLeak ElasticSearch|
|2019.10.22|//Uptycs//|[[3 Cloud Computing Security Issues & How To Get Them Under Control|https://www.uptycs.com/blog/cloud-computing-and-security]]|Misc|
|>|>|>|!2019.10.21|
|2019.10.21|CIGREF[>img[iCSF/flag_fr.png]]|[[Cloud de confiance : les entreprises membres du Cigref proposent à l'État leur collaboration|https://www.cigref.fr/cloud-de-confiance-entreprises-membres-du-cigref-proposent-a-etat-leur-collaboration]]|Sovereign_Cloud||
|2019.10.21|(ISC)2|[[PCI Compliance in AWS - Simplified|https://blog.isc2.org/isc2_blog/2019/10/pci-compliance-in-aws-simplified.html]]|
|2019.10.21|DZone|[[Designing Your First App in Kubernetes: A Summary|https://dzone.com/articles/designing-your-first-app-in-kubernetes-a-summary]]|Kubernetes|
|2019.10.21|VPNmentor|[[Report: Travel Reservations Platform Leaks US Government Personnel Data|https://www.vpnmentor.com/blog/us-travel-military-leak/]]|Data_Leaks ElasticSearch|
|2019.10.21|ZDnet| → [[Open database leaked 179GB in customer, US government, and military records|https://www.zdnet.com/article/autoclerk-database-leaked-customer-government-and-military-personal-records/]]|Data_Leaks ElasticSearch|
|2019.10.22|InfoSecurity Mag| → [[US Military Personnel Exposed in Latest Cloud Data Leak|https://www.infosecurity-magazine.com/news/military-personnel-exposed-latest/]]|Data_Leaks ElasticSearch|
|2019.10.22|DataBreach Today| → [[Unsecure Database Exposed US Military Personnel Data: Report - Exposed Database Owned by AutoClerk Hotel Reservation Management System|https://www.databreachtoday.co.uk/unsecure-database-exposed-us-military-personnel-data-report-a-13280]]|Data_Leaks ElasticSearch|
|2019.10.22|The Register| → [[Messed Western: Vuln hunters say hotel giant's Autoclerk code exposed US soldiers' info, travel plans, passwords|https://www.theregister.co.uk/2019/10/22/autoclerk_army_data/]]|Data_Leaks ElasticSearch|
|2019.10.21|InfoSec Institute|[[Lessons learned: The Capital One breach|https://resources.infosecinstitute.com/lessons-learned-the-capital-one-breach/]]|CapitalOne	??	|
|2019.10.21|CSO|[[Top cloud security controls you should be using|https://www.csoonline.com/article/3208905/top-cloud-security-controls-you-should-be-using.html]]|Controls|
|2019.10.21|CRN AU|[[Senate pushes fix to allow US access to local clouds|https://www.crn.com.au/news/senate-pushes-fix-to-allow-us-access-to-local-clouds-532613]]|CLOUD_Act|
|2019.10.21|//Heimdal//|[[New Microsoft Phishing Campaign Targets Office365 Users|https://heimdalsecurity.com/blog/new-microsoft-phishing-campaign-targets-office365-users/]]|O365 Phishing|
|2019.10.21|//Microsoft//|[[Unverified Sender|https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/unverified-sender-feature]]|O365 Mail|
|2019.10.21|Bleeping Computer| → [[Office 365 Now Warns About Suspicious Emails with Unverified Senders|https://www.bleepingcomputer.com/news/microsoft/office-365-now-warns-about-suspicious-emails-with-unverified-senders/]]|O365 Mail|
|2019.10.21|//eXemplify//|[[Why There May Be Room for Cloud Solutions in Your Compliance Strategy|http://www.exemplifygroup.com/why-there-may-be-room-for-cloud-solutions-in-your-compliance-strategy/]]|Compliance|
|2019.10.21|//Efficient IP//|[[Cloud to the Edge Brings IP Space Complexity|https://www.efficientip.com/cloud-edge/]]|Misc|
|2019.10.21|//Microsoft//|[[Run a disaster recovery drill for Azure VMs to a secondary Azure region|https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-azure-tutorial-dr-drill]]|Azure DRP|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Octobre 2019]]>>
[>img(150px,auto)[iCSF/MITRE.png]]Début octobre 2019, le [[MITRE]] a publié une extension du cadre ''MITRE ATT&CK'' pour le Cloud.

Ainsi, 36 techniques ont été ajoutées ou mises à jour pour couvrir le comportement d'attaquants contre les plates-formes Cloud.
Le ''MITRE ATT&CK Cloud'' est ainsi décliné pour :
* les plates-formes IaaS : Amazon Web Services (AWS), Microsoft Azure (Azure) et Google Cloud Platform (GCP)
* les plates-formes SaaS
* deux environnements plus spécifiques : Azure Active Directory (Azure AD) et Office 365

A noter :[>img(auto,50px)[iCSF/MITRE_ATTACK.png]]
* La matrice ''ATT&CK Cloud'' et ses déclinaisons peuvent être prises en compte séparément du reste de la matrice ''ATT&CK Enterprise''.
* La définition du mouvement latéral a été étendue afin d'intégrer l'accès et l'interaction avec le Cloud.
* La liste actuelle des plates-formes cloud sera étendue dans le courant de l'année prochaine.

Les différents élements sont les suivants :
* MITRE ATT&CK +++*[»]> <<tiddler [[MITRE ATTACK]]>>=== 
* MITRE ATT&CK Cloud +++*[»]> <<tiddler [[MITRE ATTACK Cloud]]>>=== 
* MITRE ATT&CK Cloud IaaS +++*[»]> <<tiddler [[MITRE ATTACK Cloud IaaS]]>>=== 
* MITRE ATT&CK Cloud SaaS +++*[»]> <<tiddler [[MITRE ATTACK Cloud SaaS]]>>=== 
* MITRE ATT&CK Cloud AzureAD +++*[»]> <<tiddler [[MITRE ATTACK Cloud AzureAD]]>>=== 
* MITRE ATT&CK Cloud O365 +++*[»]> <<tiddler [[MITRE ATTACK Cloud O365]]>>=== 

Lien → https://attack.mitre.org/matrices/enterprise/cloud/
[img(400px,2px)[iCSF/BluePixel.gif]]
[>img(300px,auto)[iCSA/JBICE.jpg]]__"''Cloud Security Alliance 2019 EMEA Congress Adds Focus on Risk Governance and European Cloud Certification Enablement''"__
Quelques précisions sur 2 sessions du prochain [[Congrès CSA EMEA|2019.11.20 - CSA Congress EMEA 2019 - Berlin]] qui se déroulera du 18 au 21 novembre 2019 à Berlin.
<<<
//__William Ochs, Rolf Becker will share insight from 60 years combined experience in banking and cybersecurity risks__
Berlin, Germany – Oct. 24, 2019 – The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today announced additions to its speaker line-up and session highlights for its [[upcoming CSA EMEA Congress (Berlin, Nov. 18-21, 2019)|2019.11.20 - CSA Congress EMEA 2019 - Berlin]]. Rolf Becker, Cloud Business Office Risk Governance, UBS Business Solutions AG, and Prof. William Ochs, EMEA Cloud Certification Enablement Manager for Cisco and co-chair of CSP CERT, will bring the issues surrounding risk governance and cloud certification enablement to the forefront, sharing their expertise after 30 years each in banking and cybersecurity, respectively. Registration is now open with special discounts being offered through November 1.

Those attending the [[2019 CSA EMEA Congress|2019.11.20 - CSA Congress EMEA 2019 - Berlin]] will also be privy to the inside scoop from some of the top cloud security media, learning about the elements behind a breaking story, research required, the missing pieces, challenges and how journalists might re-write the story over again.

"CSA has led the industry in research and development of best practices surrounding the General Data Protection Regulation (GDPR) and how it relates to cloud security. This year's ''CSA EMEA Congress'' will continue to build on lessons learned 18 months after GDPR's implementation as part of our ongoing mission to help both customers and cloud providers navigate the confluence of security, privacy, governance and compliance," said Daniele Catteddu, Chief Technology Officer, Cloud Security Alliance.

Focusing on two tracks — ''Cloud Privacy, Governance, and Compliance'' and ''Best Practices in Cybersecurity'' — attendees will have the chance to hear from some of the leading cloud and privacy thought leaders and policy makers.

The following panels and speakers have been added to the agenda:
* ''The European Cloud Certification Scheme: Forward Together''. Presenter: Prof. William Ochs, EMEA Cloud Certification Enablement Manager, Cisco and co-chair of CSP CERT.
** This session will review the origins of the European-wide Cloud Certification scheme, its security levels, and provide participants with both the current state of codification efforts and a picture of the next steps currently underway within both ENISA and the EU Commission. Alignment of the certification, with respect to CSA, will also be discussed. Participants will be prepared with a current understanding of CSPCERT's recommended steps for the EU Commission and ENISA, whom are key EU stakeholders with respect to cloud security certification strategies.
* ''Risk Governance on Cloud Adoption and Information Security in a Tightly Regulated Environment''. Presenter: Rolf Becker, UBS Business Solutions AG, Cloud Business Office Risk Governance.
** Cloud adoption is an enabler for efficiency, scalability, flexibility, and survival critical in a rapidly changing business environment. Attendees will learn how risk governance is an enabler for cloud adoption within highly regulated industries, such as financial services, and how it simultaneously helps organizations comply with regulatory and client demands for transparency and control.
* Panel: ''Press Perception of Cloud Technology''.
** With increased security threats to cloud technology and services quickly demanding the attention and reporting from the nation's top media, there is a lot to translate and comprehend to understand this highly complex and technical industry. In this session, some of the most credible and knowledgeable media in cloud reporting come together for a friendly discussion on cloud reporting greatness, grief and grunts. They'll pull back the curtain on some of their most recent reporting to help the audience understand the elements behind a breaking story, research required, the missing pieces, challenges and how they might re-write the story all over again. Attendees will also get a sneak peek into stories in development for the next cloud news item.
//
<<<
Pour en savoir plus et s'incrire :
* Annonce → ''[[CloudSecurityAlliance.fr/go/jaoa/|https://cloudsecurityalliance.fr/go/jaoa/]]''
* Détails et inscription → ''[[CloudSecurityAlliance.fr/go/jBjE/|https://cloudsecurityalliance.fr/go/jBjE/]]''
!"//Corporate Contractors and the Requirement for Zero-Trust Network Access//"
[>img(150px,auto)[iCSA/JALBC.jpg]]Article de blog publié le 21 octobre 2019 — Rédigé par Etay Bogner, VP, Zero-Trust Products Proofpoint, auparavant PDG de Meta Networks
<<<
//It's not a stretch to say that most industries and organizations today have contractors in the mix who need remote access to the company's network. Yet the traditional virtual private network (VPN) method of enabling access for corporate contractors — as well as other third parties such as vendors, partners, and customers — has a key flaw. The VPN model, by design, requires companies to place excessive trust in every contractor and third party who taps into the network, when a "zero trust" approach is really what's needed.

What I mean by that is that contractors generally only require access to specific applications on the network to conduct company business, not to have free reign over the whole enchilada. Companies take security risks by enabling their team of remote contractors to have excessive access. To limit those risks, IT administrators are wise to upgrade from a conventional VPN approach and adopting a software-defined perimeter (SDP) security model that enables the principles of zero-trust security. What it means to have zero-trust network access is that the solution not only provides segmented access for every user, but also verifies and audits that access.

Here's an example of what this might look like in practice if you have two remote contractors — let's call them A and B. With zero-trust SDP architecture, Remote Contractor A might have her access restricted to a single cloud-based application, as well as one application in the data center. Meanwhile, Remote Contractor B might only be able to access one application at headquarters. Neither Remote Contractor A nor Remote Contractor B are greenlighted to access the full corporate network/data center, but instead receive very finely grained access, as granted by IT, based on each manager's and/or department's project requirements.

As you can imagine, there are a number of clear benefits in providing zero-trust network access for all of your corporate contractors. Below is a summary of four of the key advantages:
# ''Risk reduction''. VPNs create a high-risk situation in terms of providing network access to remote contractors, as VPNs were not designed with this particular use case in mind. Alternatively, using a zero-trust SDP network allows for the creation of boundaries around any application based on identity and context. An SDP approach also allows an enterprise to ensure that each contractor's device follows a customized policy that's enforced. Meanwhile, any resources that a specific contractor is unauthorized to access remain invisible to the contractor, which reduces the surface for potential attacks.
# ''App-specific access, not full network access''. On a related note, the SDP allows your company to outline security policies at a granular level, associating specific remote contractors with the exact applications and/or services that they require. This is a huge security advantage compared to VPNs, which roll out free access to the entire corporate network. SDP can accomplish this goal easily since each contractor's user device can be assigned its own authenticated, unique identity, which then gets verified and authorized for every packet in real-time. Segmenting and securing access means that IT can designate each contractor the exact access he or she requires for a specific job to a limited subset of applications. This helps avoid potential security risks as mentioned above, as well as operational overhead.
# ''Easy management''. VPN configuration is notoriously complex, but an SDP approach allows for much simpler processes and management. You can use one cloud console to manage access policies for all enterprise resources in the cloud or data center. You can also easily tackle tasks like:
** Onboarding new remote contractors
** Assigning role-based policies
** Sending a link to enable remote contractors to access a specific application from their browser 
In particular, the onboarding of new contractors can be a real headache with a traditional VPN client, requiring annoying configuration issues and time-consuming troubleshooting, which can quickly become unsustainable if you're not managing contractors' devices. Fully onboarding a new remote contractor could potentially take days or even weeks in this circumstance, presenting impediments to your enterprise's ability to focus on key parts of your business. These distractions vanish when you switch to an SDP solution. # ''Superior experience for contractors''. No more VPN headaches for your remote contractors; SDP allows for a much more consistent and reliable experience with easy, transparent, worldwide access. The central management of a zero-trust network, which covers all of your applications and data, as well as all of your contractors and other third parties, assures not only granular security for the enterprise, but also a positive experience for users that will help improve retention of remote contractors. If you have a widely distributed workforce or work with remote contractors in any capacity, consider the above benefits when weighing whether to continue with a legacy-style VPN, or switch to an architecture that's user-centric and zero-trust. The latter offers secure, granular, controlled access to specific parts of your network or software platform and can be enforced consistently no matter where contractors are based or working — huge benefits in today's increasingly distributed work environment.// [...] <<< &rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jalb/]] sur le blog de la CSA. &rArr; https://blog.cloudsecurityalliance.org/2019/10/21/corporate-contractors-and-the-requirement-for-zero-trust-network-access/
!1 - Les nouveautés CSA de la semaine du 14 au 20 octobre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Introducing Reflexive Security for integrating security, development and operations''+++*[»]> <<tiddler [[2019.10.14 - Blog : 'Introducing Reflexive Security for integrating security, development and operations']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.10.20 - Veille Hebdomadaire]] avec plus de 50 liens :
* __''À lire'' :__ Document "''Trusted Cloud: Microsoft Azure security, privacy, compliance, resiliency, and protected IP''"+++*[»]>
|2019.10.16|//Microsoft Azure//|[[Trusted Cloud: security, privacy, compliance, resiliency, and IP|https://azure.microsoft.com/en-us/blog/trusted-cloud-security-privacy-compliance-resiliency-and-ip/]] ([[document|http://download.microsoft.com/download/1/6/0/160216AA-8445-480B-B60F-5C8EC8067FCA/WindowsAzure-SecurityPrivacyCompliance.pdf]])|Compliance Resilience|
=== 
* Alerte : malware ''Graboid'' visant des containers Docker+++*[»]>
|2019.10.16|//PaloAlto Networks//|![[Graboid: First-Ever Cryptojacking Worm Found in Images on Docker Hub|https://unit42.paloaltonetworks.com/graboid-first-ever-cryptojacking-worm-found-in-images-on-docker-hub/]]|Docker 
CryptoJacking
Attacks| |2019.10.16|Bleeping Computer| → [[Unsecured Docker Hosts Attacked by New Graboid Cryptojacking Worm|https://www.bleepingcomputer.com/news/security/unsecured-docker-hosts-attacked-by-new-graboid-cryptojacking-worm/]]|~| |2019.10.16|Dark reading| → [[Cryptojacking Worm Targets and Infects 2,000 Docker Hosts|https://www.darkreading.com/cloud/cryptojacking-worm-targets-and-infects-2000-docker-hosts/d/d-id/1336104]]|~| |2019.10.16|DataBreach Today| → [['Graboid' Cryptojacking Worm Spreads Through Containers|https://www.databreachtoday.com/graboid-crytopjacking-worm-spreads-through-containers-a-13256]]|~| |2019.10.16|//Threatpost//| → [[Docker Containers Riddled with Graboid Crypto-Worm|https://threatpost.com/docker-containers-graboid-crypto-worm/149235/]]|~| ===, analyse de 2 vulnérabilités Kubernetes+++*[»]> |2019.10.16|//PaloAlto Networks//|![[Analysis of Two Newly Patched Kubernetes Vulnerabilities|https://blog.paloaltonetworks.com/2019/10/cloud-kubernetes-vulnerabilities/]]|Kubernetes CVE-2019-11253 CVE-2019-16276| |2019.10.16|//Threatpost//| → [[Dangerous Kubernetes Bugs Allow Authentication Bypass, DoS|https://threatpost.com/kubernetes-bugs-authentication-bypass-dos/149265/]]|Kubernetes CVE-2019-11253 CVE-2019-16276| === * Pannes : authentification O365 (18 oct.)+++*[»]> |2019.10.18|Bleeping Computer|[[Microsoft 365 Authentication Outage, Users Unable to Login|https://www.bleepingcomputer.com/news/microsoft/microsoft-365-authentication-outage-users-unable-to-login/]]|Outage
O365| |2019.10.18|//Microsoft//| → [[Admins who are unable to access the admin center can find updates on the MFA outage MO193431 through status.office.com|https://mobile.twitter.com/MSFT365Status/status/1185211082941648897]]|~| |2019.10.18|Redmond Channel Partner| → [[Azure AD Outage Linked to Multifactor Authentication Issues|https://rcpmag.com/articles/2019/10/18/azure-ad-outage-linked-to-mfa.aspx]]|~| |2019.10.25|The Register| → [[You're flowing it wrong: Bad network route between Microsoft, Apple blamed for Azure, O365 MFA outage|https://www.theregister.co.uk/2019/10/25/microsoft_outage_explainer/]]|~| === * Divers : Cloud Souverain et "Cloud de Confiance", sécurisation de containers Docker !3 - Conférences et Salons * Le programme de la ''Cloud & Cyber Security Expo'' des ''27 et 28 novembre'' à Paris est partiellement disponible : ** Premier teaser et inscription gratuite+++*[»]> <<tiddler [[2019.10.11 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (1/3)]]>>=== ** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== * Les inscriptions pour le ''Congrès Européen'' des ''18 au 21 novembre'' à Berlin sont toujours ouverte+++*[»]> <<tiddler [[2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]>>=== ** Contactez-nous pour avoir une réduction sur votre inscription.+++*[»]> → [img(200px,auto)[iCSF/Email-CSA_FR.png]]=== !4 - Contacts Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Octobre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.10.19|
|2019.10.19|//JumpCloud//|[[Top Cloud Directory Service|https://jumpcloud.com/blog/top-cloud-directory-service/]]|Directories|
|>|>|>|!2019.10.18|
|2019.10.18|Bleeping Computer|[[Microsoft 365 Authentication Outage, Users Unable to Login|https://www.bleepingcomputer.com/news/microsoft/microsoft-365-authentication-outage-users-unable-to-login/]]|Outage O365|
|2019.10.18|//Microsoft//| → [[Admins who are unable to access the admin center can find updates on the MFA outage MO193431 through status.office.com|https://mobile.twitter.com/MSFT365Status/status/1185211082941648897]]|Outage O365|
|2019.10.18|Redmond Channel Partner| → [[Azure AD Outage Linked to Multifactor Authentication Issues|https://rcpmag.com/articles/2019/10/18/azure-ad-outage-linked-to-mfa.aspx]]|Outage O365|
|2019.10.18|Security Boulevard|[[Hybrid Cloud's Impact on Financial Services Security|https://securityboulevard.com/2019/10/hybrid-clouds-impact-on-financial-services-security/]]|Misc|
|2019.10.18|JDSupra|[[Singapore Issues Guidelines on Personal Data Protection and Cloud Services|https://www.jdsupra.com/legalnews/singapore-issues-guidelines-on-personal-30298/]]|Singapore Regulations|
|2019.10.18|CBR Online|[[The Security Risks of Cloud Computing Start With You|https://www.cbronline.com/feature/security-risks-of-cloud-computin]]|Risks|
|2019.10.18|Container Journal|[[Multi-Cloud, Hybrid Cloud and Kubernetes|https://containerjournal.com/topics/container-ecosystems/multi-cloud-hybrid-cloud-and-kubernetes/]]|Kubernetes Hybrid_Cloud|
|>|>|>|!2019.10.17|
|2019.10.17|Anton Chuvakin|[[Move to Cloud: A Chance to Finally Transform Security?|https://medium.com/anton-on-security/move-to-cloud-a-chance-to-finally-transform-security-e9614aae4f9c]]||
|2019.10.17|Infosec Island|[[Myth Busters: How to Securely Migrate to the Cloud|http://www.infosecisland.com/blogview/25225-Myth-Busters-How-to-Securely-Migrate-to-the-Cloud.html]]|Migration|
|2019.10.17|Bleeping Computer|[[Microsoft Adds Azure AD Sign-In History to Detect Unusual Activity|https://www.bleepingcomputer.com/news/microsoft/microsoft-adds-azure-ad-sign-in-history-to-detect-unusual-activity/]]|AzureAD Detection|
|2019.10.17|FedScoop|[[Pentagon developing JEDI cloud deployment security guidance|https://www.fedscoop.com/pentagon-jedi-security-guidance/]]|Government JEDI|
|2019.10.17|Solutions Review|[[8 Cloud Security Questions Your Business Needs to Ask|https://solutionsreview.com/cloud-platforms/8-cloud-security-questions-your-business-needs-to-ask/]]|Misc|
|2019.10.17|//Managed Methods//|[[5 Ways To Detect A Cloud Account Takeover|https://managedmethods.com/blog/5-ways-to-detect-a-cloud-account-takeover/]]|Detection|
|2019.10.17|//Panda Security//|[[48% of corporate data is now stored on the cloud|https://www.pandasecurity.com/mediacenter/security/cloud-security-encryption/]]|Storage|
|2019.10.17|//Radware//|[[Radware Unveils WAF for Kubernetes|https://containerjournal.com/topics/container-security/radware-unveils-waf-for-kubernetes/]]|Kubernetes WAF|
|2019.10.17|//CompareTheCloud|//|[[6 Pros and Cons of Cloud Storage for Business|https://www.comparethecloud.net/articles/6-pros-and-cons-of-cloud-storage-for-business/]]|Storage|
|2019.10.17|//Google//|[[Best practices for a more secure login in Google Cloud|https://cloud.google.com/blog/products/identity-security/best-practices-for-a-more-secure-login-in-google-cloud]]|GCP Authentication|
|2019.10.17|//AWS//|![[Denial of Service Attack Mitigation on AWS|https://aws.amazon.com/answers/networking/aws-ddos-attack-mitigation/]]|AWS DDoS Mitigation|
|>|>|>|!2019.10.16|
|2019.10.16|Sky News|[[Job applicants worried as hundreds of thousands of CVs exposed online|https://news.sky.com/story/job-applicants-worried-as-hundreds-of-thousands-of-cvs-exposed-online-11836935]]|DataBreach AWS Misconfiguration|
|2019.10.17|SiliconAngle| → [[250,000 resumes exposed in latest case of misconfigured cloud storage|https://siliconangle.com/2019/10/17/250000-resumes-exposed-latest-case-misconfigured-aws-cloud-storage/]]|DataBreach AWS Misconfiguration|
|2019.10.17|SC Magazine| → [[Open AWS buckets expose more than 200K CVs at two online recruitment firms|https://www.scmagazine.com/home/security-news/cloud-security/open-aws-buckets-expose-more-than-200k-cvs-at-two-online-recruitment-firms/]]|DataBreach AWS Misconfiguration|
|2019.10.16|Open Web Foundation|[[Rudr: A Kubernetes implementation of the Open Application Model specification|https://github.com/oam-dev/rudr]]|Kubernetes Tools|
|2019.10.16|Open Web Foundation| → [[Open Application Model|https://openappmodel.io/]]|Kubernetes Tools|
|2019.10.17|//Alibaba//| → [[Announcing the Open Application Model (OAM), an Open Standard for Developing and Operating Applications on Kubernetes and Other Platforms|https://medium.com/@Alibaba_Cloud/announcing-the-open-application-model-oam-an-open-standard-for-developing-and-operating-909c4fa16a6]]|Kubernetes Tools|
|2019.10.16|CBR Online|[[Sovereign Cloud: Where in the World is Public Sector Data Stored?|https://www.cbronline.com/opinion/sovereign-cloud]]|Sovereign_Cloud|
|2019.10.16|//PaloAlto Networks//|![[Graboid: First-Ever Cryptojacking Worm Found in Images on Docker Hub|https://unit42.paloaltonetworks.com/graboid-first-ever-cryptojacking-worm-found-in-images-on-docker-hub/]]|Docker CryptoJacking Attacks Graboid|
|2019.10.16|Bleeping Computer| → [[Unsecured Docker Hosts Attacked by New Graboid Cryptojacking Worm|https://www.bleepingcomputer.com/news/security/unsecured-docker-hosts-attacked-by-new-graboid-cryptojacking-worm/]]|Docker CryptoJacking Attacks Graboid|
|2019.10.16|Dark reading| → [[Cryptojacking Worm Targets and Infects 2,000 Docker Hosts|https://www.darkreading.com/cloud/cryptojacking-worm-targets-and-infects-2000-docker-hosts/d/d-id/1336104]]|Docker CryptoJacking Attacks Graboid|
|2019.10.16|DataBreach Today| → [['Graboid' Cryptojacking Worm Spreads Through Containers|https://www.databreachtoday.com/graboid-crytopjacking-worm-spreads-through-containers-a-13256]]|Docker CryptoJacking Attacks Graboid|
|2019.10.16|//Threatpost//| → [[Docker Containers Riddled with Graboid Crypto-Worm|https://threatpost.com/docker-containers-graboid-crypto-worm/149235/]]|Docker CryptoJacking Attacks Graboid|
|2019.10.16|//Tripwire//|[[Revisiting The Concepts of Disaster Recovery and Risk as Organizations Move Their Infrastructure To The Cloud|https://www.tripwire.com/state-of-security/security-data-protection/cloud/revisiting-the-concepts-of-disaster-recovery-and-risk-as-organizations-move-their-infrastructure-to-the-cloud/]]|DRP|
|2019.10.16|//PaloAlto Networks//|![[Analysis of Two Newly Patched Kubernetes Vulnerabilities|https://blog.paloaltonetworks.com/2019/10/cloud-kubernetes-vulnerabilities/]]|Kubernetes CVE-2019-11253 CVE-2019-16276|
|2019.10.16|//Threatpost//| → [[Dangerous Kubernetes Bugs Allow Authentication Bypass, DoS|https://threatpost.com/kubernetes-bugs-authentication-bypass-dos/149265/]]|Kubernetes CVE-2019-11253 CVE-2019-16276|
|2019.10.16|//Microsoft Azure//|[[Trusted Cloud: security, privacy, compliance, resiliency, and IP|https://azure.microsoft.com/en-us/blog/trusted-cloud-security-privacy-compliance-resiliency-and-ip/]] ([[document|http://download.microsoft.com/download/1/6/0/160216AA-8445-480B-B60F-5C8EC8067FCA/WindowsAzure-SecurityPrivacyCompliance.pdf]])|Compliance Resilience|
|2019.10.16|//Forcepoint//|[[Exploring SaaS security best practices|https://www.forcepoint.com/blog/insights/exploring-saas-security-best-practices]]|Misc|
|>|>|>|!2019.10.15|
|2019.10.15|Ajay Kumar|[[How CASB Can Help Cloud Security Concerns?|https://medium.com/@intouchajay/how-casb-can-help-cloud-security-concerns-710b77941e19]]|CASB|
|2019.10.15|Security Week|![[Securing All Cloud Deployments With a Single Strategy|https://www.securityweek.com/securing-all-cloud-deployments-single-strategy]]|Strategy|
|2019.10.15|//AT&T Cybersecurity//|[[Security monitoring for managed cloud Kubernetes|https://www.alienvault.com/blogs/labs-research/security-monitoring-for-managed-cloud-kubernetes]]|Kubernetes Monitoring|
|2019.10.15|//CyberArk//|[[Keeping up with cloud threats|https://www.professionalsecurity.co.uk/products/cyber/keeping-up-with-cloud-threats/]]|Threats|
|>|>|>|!2019.10.14|
|2019.10.14|Les Echos[>img[iCSF/flag_fr.png]]|[[La France cherche son "cloud de confiance"|https://www.lesechos.fr/tech-medias/hightech/la-france-cherche-son-cloud-de-confiance-1139875]]|Sovereign_Cloud|
|2019.10.14|Wojciech|[[Fun with Amazon S3 - Leaks and bucket takeover attack|https://medium.com/@woj_ciech/fun-with-amazon-s3-leaks-and-bucket-takeover-attack-ddb17da1c431]]|AWS Data_Leaks S3|
|2019.10.14|0x00sec|![[Securing Docker Containers|https://0x00sec.org/t/securing-docker-containers/16913/1]]|Docker Best_Practices|
|2019.10.14|Infosec Institute|[[AWS vs. Azure vs. Cloud+: To specialize, generalize or both?|https://resources.infosecinstitute.com/aws-vs-azure-vs-cloud-plus/]]|Training Certification|
|2019.10.14|Dark Reading|[[When Using Cloud, Paranoia Can Pay Off|https://www.darkreading.com/cloud/when-using-cloud-paranoia-can-pay-off/d/d-id/1336075]]|Misc|
|2019.10.14|//Vera//|[[Mitigating Cloud Misconfiguration Risks to Your Data|https://vmblog.com/archive/2019/10/14/mitigating-cloud-misconfiguration-risks-to-your-data.aspx]]|Risks|
|2019.10.14|//JumpCloud//|[[GPOs "as-a-Service"|https://jumpcloud.com/blog/gpos-as-a-service/]]|GPO|
|2019.10.14|//Viruss//|[[Defining Cloud Security – Is It the Endpoint, Your Data, or the Environment?|http://www.viruss.eu/virus-news/defining-cloud-security-is-it-the-endpoint-your-data-or-the-environment/]]|Misc|
|2019.10.14|//Tripwire//|[[Private Cloud vs Public Cloud Security Challenges|https://www.tripwire.com/state-of-security/security-data-protection/cloud/private-public-cloud-security-challenges/]]|Challenges|
|2019.10.14|//Securosis//|[[Enterprise DevSecOps: Security Test Integration and Tooling|https://securosis.com/blog/enterprise-devsecops-security-test-integration-and-tooling]]|DevSecOps|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Octobre 2019]]>>
!"//Introducing Reflexive Security for integrating security, development and operations//"
[>img(150px,auto)[iCSA/JAEBI.jpg]]Article de blog publié le 14 octobre 2019 — Rédigé par le groupe de travail CSA DevSecOps
<<<
//Organizations today are confronted with spiraling compliance governance costs, a shortage of information security professionals, and a disconnect between strategic security and operational security. Due to these challenges, more and more companies value agility and integrated operations. In short, a security management program must now deliver more for less to match the needs of becoming cost efficient. 

How can organizations accomplish this task? In order to answer that question, CSA recently published a document defining ''Reflexive Security'', a new framework that addresses today's increasing risks and cybersecurity threats. 

[>img(250px,auto)[iCSA/J87PS.png]]__Information Security Management through Reflexive Security - Six Pillars in the Integration of Security, Development and Operations__+++*[»]> <<tiddler [[2019.08.07 - Publication : 'Six Pillars of DevSecOps']]>>=== 
This document provides a flexible framework that: 
* Focuses on collaboration and integration 
* Is outcome-oriented 
* Provides a "reflexive" response to risks. 

The word "Reflexive" comes from the reflexive relation in mathematical sets, where every element in such a relation is related to itself. In Reflexive Security, every action taken is related to the context of the security at hand and needs of the organization itself. 

__Reflexive Security versus ISMS__
While the information security management system (ISMS) approach is well-defined by the International Standard ISO/IEC 27001, organizations who thrive with agile development or other collaborative-oriented processes have found it valuable to use the Reflexive Security framework. They value it for its non-prescriptive, holistic, needs-based, and interactive approach, especially with their existing activities that are already tightly-integrated. 

Reflexive Security builds on the examples from Agile development and DevOps movements, and is solely focused on a collaborative and integrated environment. It is especially suited for cloud environments, which are crucial for facilitating efficiencies for development and operation teams. Compared to the ISMS approach, Reflexive Security is like using Agile software development versus the Waterfall mindset. 

Reflexive Security also emphasizes security across organizational roles that reacts to external and internal threats. Similar to the body's immune system, Reflexive Security values the balance of decentralization and centralization over a top-down leadership approach. This is so responsibilities and activities of information security management are infused to all members of the organization. 

The document describes the core principles of Reflexive Security in "Six Pillars," which leads to the "Six Benefits," and also explores a number of strategies for the fulfillment of this framework. 

__The Six Pillars of Reflexive Security (abbreviated as "RAMPAC"):__
* ''Responsible collectively'': Security leadership plays a shepherding role for information security within an organization; everyone is responsible for an organization's security.
* ''Pragmatic'': Security should provide value, not a hindrance.
* ''Align and bridge'': Organizational risks and requirements must be fully aligned in order to derive maximum effectiveness and value from security processes.
* ''Automate'': Automated security practices are the core of optimizing process efficiency.
* ''Measure and improve'': Performance that cannot be measured cannot be improved.
* ''Collaborate and integrate'': Arguably the most important Pillar. Security can only be achieved through collaboration, not confrontation. A security-aware and collaborative culture is necessary for everyone to feel comfortable reporting potential anomalies. 

__The Six Benefits of Reflexive Security:__
* ''Human-centric'': Security is integrated and internalized as an aspect of everyone's work, and requires mind-share within every employee.
* ''Elastic'': Growing maturity of a Reflexive Security approach could lead to achievement of formal ISMS requirements, while being flexible enough to only target critical areas for maximum value based on actual risks.
* ''Apt and holistic'': Focused on business needs and responding to the actual risk context faced by the organization when compared to traditional information security management.
* ''Resilient'': Security no longer relies on a single security function, but security practices are integrated with business processes and embedded throughout the organization. 
* ''Tailored'': Prioritized approach to provision stronger protection to core or more vulnerable processes over those less exploitable. 
* ''Dynamic'': The protection of business goals is performed by integrating security with business processes, allowing the organization to react faster and more effectively to threats and incidents. 

__Key Takeaways__
Reflexive Security is an information security management strategy that is dynamic, interactive, holistic, and effective. It represents cultural practices extrapolated from existing collaborative concepts and practices, and provides a set of widely implicating and easily understandable principles that affect an organization's cybersecurity posture. This approach is especially suitable for organizations operating under resource and personnel constraints in today's fast-paced and challenging cybersecurity landscape.//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jaeb/]] sur le blog de la CSA.
!1 - Les nouveautés CSA de la semaine du 7 au 13 octobre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Cloud Penetration Testing the Capital One Breach''+++*[»]> <<tiddler [[2019.10.10 - Blog : 'Cloud Penetration Testing the Capital One Breach']]>>=== 
* Blog : ''It's all about the Data! – Preventative Security''+++*[»]> <<tiddler [[2019.10.08 - Blog : 'It's all about the Data! – Preventative Security']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.10.13 - Veille Hebdomadaire]] avec plus de 70 liens :
* __''À consulter'' :__ "Azure Benchmark" du CIS+++*[»]> 
|2019.10.10|//Microsoft//|[[CIS Azure Security Foundations Benchmark open for comment|https://azure.microsoft.com/en-us/blog/cis-azure-security-foundations-benchmark-open-for-comment/]] ([[draft|https://azure.microsoft.com/mediahandler/files/resourcefiles/azure-cloud-security-benchmark-draft/azure-cloud-security-benchmark-draft.pdf]])|Azure CIS_Benchmark|
|2019.10.10|Center for Internet Security| → [[CIS Microsoft Azure Foundations Benchmark v1.0.0 Now Available|https://www.cisecurity.org/blog/cis-microsoft-azure-foundations-benchmark-v1-0-0-now-available/]] ([[téléchargement|https://www.cisecurity.org/benchmark/azure/]])|Azure CIS_Benchmark|
=== 
* Sécurité des Managed Service Providers : un appel à commentaires sur un document du ''NIST'' et quelques pistes d'amélioration par MalwareBytes
* Rapports et sondages : FireEye, Thales
* Divers : CLOUD Act en Australie et en Suisse, réduction de la surface d'attaque
!3 - Conférences et Salons
* Le programme de la ''Cloud & Cyber Security Expo'' des ''27 et 28 novembre'' à Paris est partiellement disponible :
** Premier teaser et inscription gratuite+++*[»]> <<tiddler [[2019.10.11 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (1/3)]]>>=== 
** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== 
* Les inscriptions pour le ''Congrès Européen'' des ''18 au 21 novembre'' à Berlin sont toujours ouverte+++*[»]> <<tiddler [[2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]>>=== 
** Contactez-nous pour avoir une réduction sur votre inscription.+++*[»]> → [img(200px,auto)[iCSF/Email-CSA_FR.png]]=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Octobre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.10.12|
|2019.10.12|CyberDefense Mag|[[What Can You Do To Secure Your Data In The Cloud?|https://www.cyberdefensemagazine.com/what-can-you-do/]]|Risks|
|2019.10.12|//BitDefender//|[[Organizations Fail to Implement Cloud Security Basics - And it Bites Them|https://businessinsights.bitdefender.com/organizations-fail-to-implement-cloud-security-basics]]|Threats Guidance|
|>|>|>|!2019.10.11|
|2019.10.11|Security Boulevard|[[The Progression to Cloud Directory Services|https://securityboulevard.com/2019/10/the-progression-to-cloud-directory-services/]]|Directories|
|2019.10.11|Silicon Republic|[[AWS's Abby Fuller on balancing progress with security|https://www.siliconrepublic.com/enterprise/abby-fuller-amazon-web-services-cloud]]|Misc|
|2019.10.11|//Duo Security//|![[Imperva Breach Stemmed From Compromised Internal Compute Instance|https://duo.com/decipher/imperva-breach-stemmed-from-compromised-internal-compute-instance]]|DataBreach Imperva Analysis|
|2019.10.11|//MalwareBytes//|![[Securing the managed service provider (MSP)|https://blog.malwarebytes.com/business-2/2019/10/securing-the-managed-service-provider-msp/]]|MSP|
|>|>|>|!2019.10.10|
|2019.10.11|DZone|[[Top 5 Security Practices for AWS Backup|https://dzone.com/articles/top-5-security-practices-for-aws-backup]]|AWS Backups|
|2019.10.11|//OVHcloud//|[[Looking Back at OVHCloud Summit 2019|https://www.ovh.com/blog/looking-back-at-ovhcloud-summit-2019/]]|OVHcloud|
|2019.10.10|Silicon.fr[>img[iCSF/flag_fr.png]]| → [[OVH affirme son identité cloud et joue l'alternative de confiance|https://www.silicon.fr/ovh-cloud-confiance-263407.html]]|OVHcloud|
|>|>|>|!2019.10.10|
|2019.10.10|AllNews.ch[>img[iCSF/flag_fr.png]]|[[CLOUD Act américain: l'ASB demande des clarifications|https://www.allnews.ch/content/r%C3%A9glementation/cloud-act-am%C3%A9ricain-l%E2%80%99asb-demande-des-clarifications]]|CLOUD_Act Switzerland|
|2019.10.10|Dark Reading|[[Network Security Must Transition into the Cloud Era|https://www.darkreading.com/cloud/network-security-must-transition-into-the-cloud-era/a/d-id/1335978]]|Networking|
|2019.10.10|nixCraft|[[Set Up a Basic Iptables Firewall on Amazon Linux AMI|https://www.cyberciti.biz/faq/set-up-a-basic-iptables-firewall-on-amazon-linux-ami/]]|AWS AMI Firewall|
|2019.10.10|MyLastWatchdog|[[CASBs help companies meet 'shared responsibility' for complex, rising cloud risks|https://www.lastwatchdog.com/my-take-casbs-help-companies-meet-shared-responsibility-for-complex-rising-cloud-risks/]]|CASB Shared_Responsibility|
|2019.10.10|CBR Online|![[Does Containerisation Spell the End for Virtualisation?|https://www.cbronline.com/news/kubernetes-and-containerisation]]|Kubernetes Containers|
|2019.10.10|Cloud Native Computing Foundation|[[How to make containers an architect's best friend|
|2019.10.10|Open Access Government|[[Top five areas of focus for CISOs when it comes to the cloud and cybersecurity|https://www.openaccessgovernment.org/cisos-cloud-and-cybersecurity/75363/]]|Guidance|
|2019.10.10|//Microsoft Azure//|[[16 new built-in roles - including Global reader - now available in preview|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/16-new-built-in-roles-including-Global-reader-now-available-in/ba-p/900749]]|AzureAD|
|2019.10.11|Bleeping Computer| → [[Microsoft Improves Azure Active Directory Security with New Roles|https://www.bleepingcomputer.com/news/microsoft/microsoft-improves-azure-active-directory-security-with-new-roles/]]|AzureAD|
|2019.10.10|//Managed Methods//|[[How Cloud DLP Fits Into Your Cybersecurity Infrastructure|https://managedmethods.com/blog/cloud-dlp-your-cybersecurity-infrastructure/]]|DLP|
|2019.10.10|//eXemplify//|[[The 4 Industries That Get the Most Out of Cloud Security|http://www.exemplifygroup.com/the-4-industries-that-get-the-most-out-of-cloud-security/]] (infographie)|Misc|
|2019.10.10|//CloudCheckr//|[[Why the Best Financial Services Are Turning to the Cloud for Risk Management|https://cloudcheckr.com/cloud-cost-management/why-the-best-financial-services-are-turning-to-the-cloud-for-risk-management/]]|Risks|
|2019.10.10|//Alibaba//|[[Building a Serverless Application on Alibaba Cloud (Part 1)|https://medium.com/@Alibaba_Cloud/building-a-serverless-application-on-alibaba-cloud-part-1-91a439e5a949]] (1/2)|Alibaba Serverless|
|2019.10.10|//Alibaba//|[[Building a Serverless Application on Alibaba Cloud (Part 2)|https://medium.com/@Alibaba_Cloud/building-a-serverless-application-on-alibaba-cloud-part-2-d710e722cf8e]] (2/2)|Alibaba Serverless|
|2019.10.10|//Threatstack//|[[20 DevSecOps Pros Reveal the Most Important Considerations in Building a DevSecOps Pipeline|https://www.threatstack.com/blog/20-devsecops-pros-reveal-the-most-important-considerations-in-building-a-devsecops-pipeline]]|DevSecOps|
|2019.10.10|//Securosis//|[[Enterprise DevSecOps: How Security Works With Development|https://securosis.com/blog/enterprise-devsecops-how-security-works-with-development]]|DevSecOps|
|2019.10.10|//Cloudbric//|[[A Guide to PCI Compliance in the Cloud|https://www.cloudbric.com/blog/2019/10/pci-compliance-cloud-guide/]]|PCI_DSS Compliance|
|2019.10.10|//Microsoft//|[[CIS Azure Security Foundations Benchmark open for comment|https://azure.microsoft.com/en-us/blog/cis-azure-security-foundations-benchmark-open-for-comment/]] ([[draft|https://azure.microsoft.com/mediahandler/files/resourcefiles/azure-cloud-security-benchmark-draft/azure-cloud-security-benchmark-draft.pdf]])|Azure CIS_Benchmark|
|2019.10.10|Center for Internet Security| → [[CIS Microsoft Azure Foundations Benchmark v1.0.0 Now Available|https://www.cisecurity.org/blog/cis-microsoft-azure-foundations-benchmark-v1-0-0-now-available/]] ([[téléchargement|https://www.cisecurity.org/benchmark/azure/]])|Azure CIS_Benchmark|
|2019.10.10|//ExtraHop//|[[Boost Your Security in AWS|https://www.extrahop.com/company/blog/2019/essential-aws-security-features-to-know/]]|AWS|
|>|>|>|!2019.10.09|
|2019.10.09|Bleeping Computer|[[Beware of Fake Amazon AWS Suspension Emails for Unpaid Bills|https://www.bleepingcomputer.com/news/security/beware-of-fake-amazon-aws-suspension-emails-for-unpaid-bills/]]|AWS Phishing|
|2019.10.09|CyberSecurity Insiders|[[Cloud Security breach leads to a leak of 957,000 patient records|https://www.cybersecurity-insiders.com/cloud-security-breach-leads-to-a-leak-of-957000-patient-records/]]|Data_Breaches Misconfigurations|
|2019.10.09|DevOps.com|[[Common Cloud Security Mistakes and How to Avoid Them|https://devops.com/common-cloud-security-mistakes-and-how-to-avoid-them/]]|Risks Guidance|
|2019.10.09|Container Journal|[[Demystifying Persistent Storage Myths for Stateful Workloads in Kubernetes|https://containerjournal.com/topics/container-networking/demystifying-persistent-storage-myths-for-stateful-workloads-in-kubernetes/]]|Persistence Kubernetes|
|2019.10.09|The Register|[[US charges Singapore coin miner with conning cloud firms out of compute time|https://www.theregister.co.uk/2019/10/09/singapore_coin_miner_charged/]]|CryptoMining|
|2019.10.09|//Rapid7//|![[Avoiding the Zombie Cloud Apocalypse: How to Reduce Exposure in the Cloud|https://blog.rapid7.com/2019/10/09/avoiding-the-zombie-cloud-apocalypse-how-to-reduce-exposure-in-the-cloud/]]|Zombies|
|2019.10.09|//Kaspersky//|[[Protecting public clouds from common vulnerabilities|https://www.kaspersky.com/blog/vulnerabilities-in-public-clouds/28905/]]|Public_Cloud RDP SSH|
|2019.10.09|//Alibaba//|[[SSH Tunnelling With Alibaba Cloud To Expose A Local Environment|https://medium.com/@Alibaba_Cloud/ssh-tunnelling-with-alibaba-cloud-to-expose-a-local-environment-7dccfeabc5a6]]|Alibaba SSH|
|>|>|>|!2019.10.08|
|2019.10.08|Silicon.fr[>img[iCSF/flag_fr.png]]|![[Cloud souverain : quels candidats pour les trois contrats|https://www.silicon.fr/cloud-souverain-candidats-263205.html]]|Sovereign_Cloud|
|2019.10.08|NIST|![[Improving Cybersecurity of Managed Service Providers|https://www.nccoe.nist.gov/projects/building-blocks/managed-service-providers]] ([[draft|https://www.nccoe.nist.gov/sites/default/files/library/project-descriptions/msp-ic-project-description-draft.pdf]], [[commentaires|https://www.nccoe.nist.gov/sites/default/files/library/msp-comments.xlsx]])|NIST MSP|
|2019.10.09|MSSP Alerts| → [[MSP Cybersecurity Initiative: NIST, NCCoE Seek Comments|https://www.msspalert.com/cybersecurity-news/msp-cybersecurity-initiative-nist-nccoe-seek-comments/]]|NIST MSP|
|2019.10.08|RIPE|[[Internet Clouds are (also) Unpredictable: A Study on the Effects of Recent Traffic Engineering Trends In Cloud Provider Networks|https://labs.ripe.net/Members/marco_chiesa/internet-clouds-are-also-unpredictable]]|Networking Latency|
|2019.10.08|Security Week|[[Cloud is Creating Security and Network Convergence|https://www.securityweek.com/cloud-creating-security-and-network-convergence]]|Misc|
|2019.10.08|Marcel Afrahim|[[Sesame Street Store & Volusion customers are comprised; how the cookie monster is stealing credit card info|https://medium.com/@marcelx/sesame-street-volusion-customers-are-comprised-how-the-cookie-monster-is-stealing-cc-numbers-21eb51ec613b]]|Supply-Chain_Attack DataBreach GCP|
|2019.10.08|ZDnet| → [[Hackers breach Volusion and start collecting card details from thousands of sites|https://www.zdnet.com/article/hackers-breach-volusion-and-start-collecting-card-details-from-thousands-of-sites/]]|Supply-Chain_Attack DataBreach GCP|
|2019.10.08|Security Boulevard|[[Public Cloud Transformation: Keys to Data Security|https://securityboulevard.com/2019/10/public-cloud-transformation-keys-to-data-security/]]|Misc|
|2019.10.08|InformationAge|[[Cyber security for IoT and edge computing|https://www.information-age.com/cyber-security-for-iot-and-edge-computing-123485616/]]|IoT|
|2019.10.08|SecureCloudBlog|[[Advisories 1-2: Azure AD and Common WS-Trust MFA Bypass explained|https://securecloud.blog/2019/10/08/advisories-1-2-azure-ad-and-common-ws-trust-mfa-bypass-explained/]]|AzureAD Attack|
|2019.10.07|ITnews AU|[[Australia, US negotiate CLOUD Act data swap pact|https://www.itnews.com.au/news/australia-us-negotiate-cloud-act-data-swap-pact-532005]]|CLOUD_Act Australia|
|2019.10.08|HelpNet Security|[[Organizations need tools that support DevOps security|https://www.helpnetsecurity.com/2019/10/08/devops-security-tools/]]|Report Trendmicro|
|2019.10.08|NextGov|[[Do You Know What's Hiding in the Cloud?|https://www.nextgov.com/ideas/2019/10/do-you-know-whats-hiding-cloud/160442/]]|Misc|
|2019.10.08|//Threatpost//|[[Intimate Details on Healthcare Workers Exposed as Cloud Security Lags|https://threatpost.com/intimate-details-healthcare-workers-exposed-cloud-security/149007/]]|Risks|
|2019.10.08|//Thales//|![[Organizations worldwide failing to adequately protect sensitive data in the cloud|https://www.thalesesecurity.com/about-us/newsroom/news-releases/thales-study-organizations-worldwide-failing-adequately-protect]]|Report Thales|
|2019.10.08|//Thales//| → [[infographie '2019 Cloud Security Study|https://go.thalesesecurity.com/rs/480-LWA-970/images/2019-Ponemon-Cloud-Security-in.pdf]] et [[rapport '2019 Cloud Security Study|https://go.thalesesecurity.com/rs/480-LWA-970/images/2019-Cloud-Security-Report-sd.pdf]]|Report Thales|
|2019.10.08|Info Security Mag| → [[Global Study Finds Orgs Are Failing to Protect Data in the Cloud|https://www.infosecurity-magazine.com/news/orgs-failing-protect-data-cloud/]]|Report Thales|
|2019.10.08|VMblog| → [[Thales Study: Organizations Worldwide Failing to Adequately Protect Sensitive Data in the Cloud|https://vmblog.com/archive/2019/10/08/thales-study-organizations-worldwide-failing-to-adequately-protect-sensitive-data-in-the-cloud.aspx]]|Report Thales|
|2019.10.10|HelpNet Security| → [[Only 32% of organizations employ a security-first approach to cloud data storage|https://www.helpnetsecurity.com/2019/10/10/cloud-data-storage-security/]]|Report Thales|
|2019.10.08|//FireEye//|[[FireEye Email Threat Update: How Attackers are Getting Ahead in the Cloud|https://www.fireeye.com/blog/products-and-services/2019/10/how-attackers-are-getting-ahead-in-the-cloud.html]] ([[détails|https://www.fireeye.com/solutions/ex-email-security-products/power-of-one.html]])|Report FireEye Threats|
|2019.10.08|Security Week| → [[Email Attacks Using Cloud Services are Increasing|https://www.securityweek.com/email-attacks-using-cloud-services-are-increasing]]|Report FireEye Threats|
|2019.10.08|//LogRhythm//|[[Six Tips for Securing Your Azure Cloud Environment|https://logrhythm.com/six-tips-for-securing-your-azure-cloud-environment/]]|Azure Best_Practices|
|2019.10.08|//Gremlin//|![[After the Retrospective: Heroku Incident #1892|https://www.gremlin.com/blog/heroku-incident-1892/]]|Lessons_Learnt AWS Heroku|
|>|>|>|!2019.10.07|
|2019.10.07|Journal du Net[>img[iCSF/flag_fr.png]]|[[Stockage : mieux protéger ses données avec le modèle flash-to-flash-to-cloud|https://www.journaldunet.com/solutions/expert/71828/stockage---mieux-proteger-ses-donnees-avec-le-modele-flash-to-flash-to-cloud.shtml]]|Storage Flash|
|2019.10.07|ZDnet|[[Australia inches closer to compelling access to US data under CLOUD Act|https://www.zdnet.com/article/australia-inches-closer-to-compelling-access-to-us-data-under-cloud-act/]]|CLOUD_Act Australia|
|2019.10.07|Technopedia|[[How Cloud Computing is Changing Cybersecurity|https://www.techopedia.com/how-cloud-computing-is-changing-cybersecurity/2/33941]]|Challenges|
|2019.10.07|Maarten Goet|[[Azure Sentinel: designing access and authorizations that meet the enterprise needs|https://medium.com/wortell/azure-sentinel-designing-access-and-authorizations-that-meet-the-enterprise-needs-501bfdafaa5f]]|Azure Snetinel|
|2019.10.07|DZone|![[The Complete Kubernetes Collection [Tutorials and Tools]|https://dzone.com/articles/the-complete-kubernetes-collection-tutorials-and-tools]]|Kubernetes Tools Tutorials|
|2019.10.07|Solutions review|[[5 Tips for Designing a Flawless Cloud Security Policy|https://solutionsreview.com/cloud-platforms/5-tips-for-designing-a-flawless-cloud-security-policy/]]|Security_Policy|
|2019.10.07|Darknet.org.uk|[[LambdaGuard - AWS Lambda Serverless Security Scanner|https://www.darknet.org.uk/2019/10/lambdaguard-aws-lambda-serverless-security-scanner/]]|Tools LambdaGuard|
|2019.10.07|//Trendmicro//|[[Trend Micro Survey Finds Lack of IT Security Input In DevOps Introduces Cyber Risk for 72% of Companies|https://devops.com/trend-micro-survey-finds-lack-of-it-security-input-in-devops-introduces-cyber-risk-for-72-of-companies/]]|Report Trendmicro|
|2019.10.07|//Microsoft Azure//|[[Customer Provided Keys with Azure Storage Service Encryption|https://azure.microsoft.com/en-us/blog/customer-provided-keys-with-azure-storage-service-encryption/]]|Azure Encryption|
|2019.10.07|//Alcide//|[[Cloud-native applications need a unified continuous security approach|https://www.helpnetsecurity.com/2019/10/07/cloud-native-applications-security/]]|Misc|
|2019.10.07|//Zscaler//[>img[iCSF/flag_fr.png]]|[[L'avenir de la prévention contre la perte de données est dans le Cloud|http://www.globalsecuritymag.fr/L-avenir-de-la-prevention-contre,20191007,91390.html]]|DLP|
|2019.10.07|//ExtraHop//|[[Your Enterprise is Cloud-First. Is Your Security?|https://www.extrahop.com/company/blog/2019/cloud-native-security-infographic/]]|Survey|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Octobre 2019]]>>
[>img(200px,auto)[iCSF/CCSEP2019.png]]Pour s'inscrire à la ''Cloud & Cyber Security Expo'' et disposer une premier aperçu du programme des conférences gratuites :

Suivez le lien → ''[[CloudSecurityAlliance.fr/go/jabr|https://CloudSecurityAlliance.fr/go/jabr]]''

[img(auto,60px)[iCSF/CCSA19h.jpg][https://CloudSecurityAlliance.fr/go/jabr]]
!"//Cloud Penetration Testing the Capital One Breach//"
[>img(200px,auto)[iCSA/JAABC.jpg]]Article de blog publié le 10 octobre 2019 — Rédigé par Alexander Getsin, Lead Author for Cloud Penetration Testing Playbook
<<<
//''Aligning the Capital One breach with the CSA Cloud Penetration Testing Playbook''

In March 2019, Capital One suffered a unique cloud breach. 140,000 Social Security numbers and 80,000 linked bank account numbers were exposed, along with some 1 million Canadian Social Insurance Numbers. It isn't the numbers that make the breach special and worth learning about.

The initial point of compromise in this breach was a misconfigured proxy (modSecuritymodProxy, a Web Application Firewall), employed by Capital One. The attacker used the misconfigured instance to steal credentials from the meta-data service of the cloud instance. This is arguably the first high-profile breach using this technique. Capital One had to deal with a novel attack that employed a cutting-edge technique exclusive to cloud environments. Despite their impressive efforts at cloud security, their chances were slim in this case.

Just a few months ago, the Cloud Security Alliance's (CSA) Top Threats Working Group published the +++*[Cloud Penetration Testing Playbook]> <<tiddler [[2019.07.12 - Publication : 'Cloud Penetration Testing Playbook']]>>===. This playbook identifies this very attack technique. The playbook also describes 94 other public cloud attack vectors, concerns, considerations and test cases for testing and attacking public cloud environments and systems.

''What was the Breach?''
The initial compromise technique employed in this breach was the abuse of a particular feature of a misconfigured proxy (a web application firewall) employed by Capital One. The nginx server hosting the web application firewall accepts web requests meant for backend applications, processes and fulfills or responds to them as a proxy does. This specific nginx misconfiguration allowed requests to the meta-data service at 169.254.169.254.

AWS infrastructure services and consumers use the meta-data service to store environment variables. Some of the many variables and data stored in the AWS meta-data service (similar to GCP and Azure) are the temporary STS credentials that allow the instance to assume any role that has been passed to it. Anyone familiar with curl or a proxy client (such as Burp proxy) can generate requests to this meta-data service if they have local access to the instance, or if the instance is misconfigured to serve web requests to its local meta-data service.

The latter was the case: the vulnerable nginx WAF proxied web requests to itself and also served any other requests. The attacker called its iam/info meta-data to get available role names and then the temporary credentials meta-data to obtain the actual credentials at
> {{{ http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name }}}
At that point, the attacker was in. Amongst other privileges, the role associated with the WAF instance had S3 bucket privileges. It's easy AWS CLI work from there. 

''What Made this Breach Special?''
This is arguably the first high-profile breach using this technique. It is novel and special in a few other ways: 
* The breach depended on a misconfiguration of a non-cloud component (the WAF software) to target an attack vector unique to cloud instances
* An ex-employee of the cloud service provider targeted clients of the cloud service provider

The more important point is that Capital One had to deal with a previously unexplored attack. AWS recognizes Capital One as a leader in cloud usage with impressive efforts at security. The fact that an ex-engineer of the CSP exploited the technical weakness only stands to show how exclusive the knowledge required, and how hard to counter this attack was.

This incident highlights increasingly sophisticated attacks that attackers can use to compromise cloud environments. The CSA Top Threats Working Group playbook provides guidance on how to test for such misconfigurations in your cloud infrastructure, reducing the knowledge gap.

''What's the Cloud Penetration Testing Playbook?''
The Cloud Penetration Testing Playbook represents a collective effort to provide guidance for the penetration testing of systems in public cloud environments.  It provides a set of testing objectives, as well as legal and compliance concerns. The overall document aims to educate key decision-makers on the complexities of penetration testing in a multi-stakeholder and vulnerabilities within a multi-layered information technology stack.

While this resource is activity-specific (penetration testing), it outlines the various methods by which attackers can and do target cloud environments. To protect information systems, defenders should be aware of the methods including those used by the Capital One threat actor.. The playbook covers most of the aspects and methodology of similar attack: 

__Initial compromise employed by the Capital One threat actor involved a misconfigured proxy server exposing temporary credentials residing in its meta-data service.__
Covered in ''Pg 13'' (of the Cloud Penetration Testing Playbook)
* c. Test for spoofing of user identity and other entities
* v. Steal credentials from meta-data of proxy or http forwarding servers (credentials in AWS meta-data)

__Data exfiltration via export of EC2 snapshots__
Covered in ''Pg 14'' (of the Cloud Penetration Testing Playbook)
* f. Test for Information disclosure (privacy breach or data leak)
* ix. Steal virtual machine images and snapshots from storage accounts; analyze them for sensitive data (likeAzure vm vhd snapshots

__Data exfiltration via download of S3 bucket objects__
Covered in ''Pg 14'' (of the Cloud Penetration Testing Playbook)
* f. Test for Information disclosure (privacy breach or data leak)iv. Exfiltrate data from publicly accessible datastore services (S3, RDS, RDS snapshots, Redshift clusters, elastic search domains) or private stores with cli / dumps (s3 aws cli get, dynamodump), and/or configure them accordingly for exfiltration).

''What Should You Do About This?''
This knowledge is now available. The playbook is a resource that CSA and Top Threats Working Group will continue to improve on.//[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jaac/]] sur le blog de la CSA.
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//It's all about the Data! – Preventative Security//"
[>img(200px,auto)[iCSA/JA8BI.jpg]]Article de blog publié le 8 octobre 2019 — Rédigé par John DiMaria, Assurance Investigatory Fellow, CSA
<<<
//I have always said I am a "data guy." Decisions made with data eliminate all bias, opinions, and ad hoc decisions that cause potential costly moves.
In my most recent podcast interview with Phillip Merrick, CEO of Fugue, he discussed how vendors sometimes use security events in order to sell fear, uncertainty, and doubt (FUD) to sell products. Nothing wrong with keeping up with world events and learning from others' mistakes, but there is a difference between prevention and reaction.

''Reactive Security''
Think about it. Smoke alarms go off after something happens; usually, a fire that causes smoke to rise and enter the alarm. At that point, running out of the building is the standard "reaction." Sure, there are all kinds of incidents that can scare you and make you run out and buy the latest technology to warn you when there is a fire, and even call 911 for you. But while you definitely need smoke alarms, doesn't it make sense to do a full evaluation of your premises and see what you can do to prevent that fire in the first place? Then, even if a fire does happen, there is a good chance the damage will be less than if you had done nothing at all. Even if you did just buy all the latest and greatest technology, how you know you addressed the critical areas unless you did a full evaluation first?
Preventative Security

The point is, why not spend your budget dollars wisely by using good data-driven decisions. A smart strategy means less complexity. Evaluate where you are at, give yourself credit for what you already have in place and spend dollars wisely on the areas that have little or no protection and/or areas that could use improvement. The fire department can provide you with a checklist or questionnaire pointing out things you should evaluate before you spend money so you know what you really need (and what you don't). Whereas a company that wants to sell you equipment can give you a hundred reasons why you should by their product, even before they know if you even need it. 

Security is similar. Evaluate where you are at today, draw out where you need to be tomorrow, and act on the differences - simple, smart, and cost-effective (not to mention a valuable budget justification).

''CSA's Questionnaire to Assess Cloud Compliance''
Think of the Consensus Assessments Initiative Questionnaire (CAIQ) as fulfilling the same purpose as the fire risk questioner. It allows you to evaluate where you are at today in meeting internationally accepted cloud-specific controls. The CAIQ is based upon the Cloud Controls Matrix (CCM) and provides a set of Yes/No questions a cloud consumer or cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the Cloud Controls Matrix. It's vendor-neutral, and some of the improvements may not even require technology, but if they do, you'll be a smarter shopper.

[>img(500px,auto)[iCSA/JA8BI.png]]As I mentioned above – simple, smart and cost effective. Once you feel you are ready and have addressed any gaps, you can submit your CAIQ to the STAR Registry and join the other 600 plus cloud service providers that have chosen to post their completed questionnaire for not only their customers to see, but potential clients as well, increasing the level of transparency and trust. The great thing is, it is scalable, and you can build on that initial step by graduating to STAR Continuous. STAR Continuous improves upon that "point in time" or "point over a period of time" analysis by requiring that the CAIQ be updated every 30 days, increasing the level of assurance. 

If you feel it is an advantage or requirement to go even further, again, you can progress to STAR Level 2; Third-Party certification or attestation and even Level 3; continuous monitoring. See the "STAR Levels" figure on the right.

Following are costs due to non-compliance as per an Independent survey conducted by Ponemon Institute on behalf of Globalscape+++*[»]>
→ http://dynamic.globalscape.com/files/Whitepaper-The-True-Cost-of-Compliance-with-Data-Protection-Regulations.pdf
=== 
These costs, as shown in this report, are 2.71 times the cost of compliance:
* Business disruption
* Productivity losses
* Revenue losses
* Fines, penalties and
* settlement costs

''Evaluate if you are compliant.''
If you are, give yourself credit and let the world know and continue to improve and advance as applicable. If not, act on the differences, fill the gaps, and then let the world know and continue to improve and consider the other levels of STAR based on your business needs and compliance requirements.//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/ja8b/]] sur le blog de la CSA.
[img(25%,1px)[iCSF/BluePixel.gif]]
!Participation au Salon ''Cloud & Cyber Security Paris'' les 27 et 28 novembre 2019
[>img(200px,auto)[iCSF/CCSEP2019.png]]Le [[Chapitre Français]] de la [[Cloud Security Alliance]] animera :
* la table-ronde "''Cyber-résilience : anticiper, maître-mot de la sécurité''" 
* le mercredi 27 novembre 2019, entre 13h05 et 13h45.

Le salon se déroulera sur 2 jours : les ''mercredi 27 et jeudi 28 novembre 2019 à Paris, Porte de Versailles''
L'entrée donne accès aux cinq espaces du Salon :
* Cloud Expo Europe, DevOps Live, Cloud & Cyber Security Expo, Data Centre World, et Big Data World
[img[iCSF/JBRSC.png]]
|Table98|k
| ! 
Pour une invitation gratuite, suivez le lien → [[CloudSecurityAlliance.fr/go/CCSEP19|https://CloudSecurityAlliance.fr/go/CCSEP19]]
  | Pour en savoir plus sur le salon : <<< //__''Cloud & Cyber Security Expo Paris 27-28 novembre 2019, Paris Porte de Versailles''__ Nous avons la chance de vivre dans un monde numérique ouvert et interconnecté. Mais comment éviter les dangers auquel il nous expose ? Devenu un rassemblement incontournable d'experts cybersécurité en France, Cloud & Cyber Security Expo Paris vous donnera les clés pour mettre en place une infrastructure numérique plus sûre et sécurisée dans votre département ou votre société. Protéger votre entreprise, c'est aussi protéger vos clients et votre pérennité. Vous apprendrez à mieux détecter, prévenir et gérer les multiples menaces en matière de cybersécurité. Venez rencontrer Sophos, Darktrace , Rohde & Schwarz CyberSecurity, Tenable, Guardicore, Hermitage Solutions, Gemalto, ITrust, Okta, BSI Group et bien d'autres ! 250 experts de l'industrie seront également présents lors d'études de cas, tables rondes et conférences pour vous guider et vous inspirer : Groupe Servier, Dailymotion, Groupe Casino, Rémy Cointreau, Médiamétrie, Carrefour Banque & Assurance, EDF Renouvelables ... Ne prenez pas le risque de passer à côté !// <<<
!1 - Les nouveautés CSA de la semaine du 30 septembre au 6 octobre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Actu : prolongation jusqu'au ''25 octobre'' pour commenter la traduction en français de 3 documents CSA+++*[»]> <<tiddler [[2019.09.19 - Actu : Demande de validation la traduction en français de 3 documents CSA]]>>=== 
* Blog : ''Why you can't have backdoored crypto that is secure''+++*[»]> <<tiddler [[2019.10.03 - Blog : 'Why you can't have backdoored crypto that is secure']]>>=== 
* Actu : Appel à commentaires, document ''Critical Controls Implementation for SAP''+++*[»]> <<tiddler [[2019.10.03 - Actu : Appel à commentaires, document 'Critical Controls Implementation for SAP']]>>=== 
* Actu : Lancement d'un ''forfait CCSK''+++*[»]> <<tiddler [[2019.10.03 - Actu : Lancement d'un forfait CCSK]]>>===, le ''Foundation Exam Bundle''+++*[»]> <<tiddler [[2019.10.03 - Actu : Forfait CCSK 'Foundation Exam Bundle]]>>=== 
* Publication : document ''Guidelines for CPAs Providing CSA STAR Attestation v2''+++*[»]> <<tiddler [[2019.10.04 - Publication : 'Guidelines for CPAs Providing CSA STAR Attestation v2']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.10.06 - Veille Hebdomadaire]] avec une cinquantaine de liens, dont :
* __''À lire'' :__ où l'on repartle du Cloud souverain avec ''Dassault Systèmes'' et ''OVH''+++*[»]>
|2019.10.03|Reuters|[[France recruits Dassault Systemes, OVH for alternative to U.S. cloud firms|https://www.reuters.com/article/us-france-dataprotection/france-recruits-dassault-systemes-ovh-for-alternative-to-u-s-cloud-firms-idUSKBN1WI189]]|Sovereign_Cloud|
|2019.10.03|Silicon.fr[>img[iCSF/flag_fr.png]]| → [[Cloud souverain : Bruno Lemaire relance Dassault Systèmes et OVH|https://www.silicon.fr/cloud-souverain-bruno-lemaire-relance-dassault-systemes-et-ovh-262679.html]]|Sovereign_Cloud|
=== 
* Divers : les zombies du Cloud+++*[»]>
|2019.10.02|//Fugue//|[[Zombie Cloud Infrastructure is a Major Security Risk|https://www.fugue.co/blog/zombie-cloud-infrastructure-is-a-major-security-risk]]|Risks Infrastructure Zombies|
===, comparaison PaaS et KaaS (Kubernetes as a Service)+++*[»]>
|2019.09.30|Container Journal|[[PaaS vs. KaaS: A Primer|https://containerjournal.com/topics/container-ecosystems/paas-vs-kaas-a-primer/]]|
=== 
* Sondages : ''Insight''+++*[»]>
|2019.10.02|Global Security Mag[>img[iCSF/flag_fr.png]]|[[Selon l'Insight Intelligent Technology Index 2019, Les services cloud inutilisés coûtent 9,6 millions d'euros aux entreprises|http://www.globalsecuritymag.fr/Selon-l-Insight-Intelligent,20190926,91105.html]]|Survey ITI|
|2019.09.30|Insight| → [[2019 Europe Index Intelligent Technology™ d'Insight|https://fr.insight.com/content/dam/insight-web/en_GB/images/2019/09/index-intelligent-technology-insight-france.pdf]]|Report|
=== 
* Rapports : évaluation Microsoft Azure pour les services du gouvernement australien+++*[»]>
|2019.10.02|//Microsoft Azure//|[[Over 100 Azure services support PROTECTED Australian government data|https://azure.microsoft.com/en-us/blog/over-100-azure-services-support-protected-australian-government-data/]]|Azure Government Australia|
|2019.10.02|//Microsoft Azure//| → [[Australia specific assessment and compliance reports, FAQs and White Papers|https://servicetrust.microsoft.com/viewpage/AustraliaV3]]|Azure Government Australia|
|2019.10.02|//Microsoft Azure//| → [[2019 Microsoft Azure IRAP (Information Security Registered Assessor Program) Assessment Report|https://servicetrust.microsoft.com/viewpage/AustraliaV3?command=Download&downloadType=Document&downloadId=ffcb3aeb-475e-4f23-8a8f-2fc7dac18d68&tab=d1b1d320-3d79-11e9-9157-b7b7eba45f26&docTab=d1b1d320-3d79-11e9-9157-b7b7eba45f26_GRC_Assessment_Reports]]|Azure Government Australia|
=== 
!3 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Octobre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.10.06|
|2019.10.06|//Tripwire//|[[Automating Secure Configuration Management in the Cloud|https://www.tripwire.com/state-of-security/security-data-protection/cloud/automating-secure-configuration-management-cloud/]]|Misc|
|2019.10.06|//Tripwire//|[[Secure Configuration in Cloud – IaaS, PaaS and SaaS Explained|https://www.tripwire.com/state-of-security/security-data-protection/cloud/secure-configuration-cloud-iaas-paas-saas/]]|Challenges|
|2019.10.06|//Alcide//|[[Kubernetes Network Policies Best Practices|https://blog.alcide.io/kubernetes-network-policies-best-practices]]|Kubernetes|
|2019.10.06|Alexandre Blanc|[[A backup strategy against ransomwares and threats (part 3)|https://www.linkedin.com/pulse/backup-strategy-against-ransomwares-threats-part-3-alexandre/]] (3/3)|Backups Ransomware|
|>|>|>|!2019.10.04|
|2019.10.04|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[OVH-Outscale : le cloud souverain vraiment ressuscité ?|https://www.lemondeinformatique.fr/actualites/lire-ovh-outscale-le-cloud-souverain-vraiment-ressuscite-76657.html]]|Sovereign_Cloud France|
|2019.10.04|FCW|[[US, UK reach CLOUD Act agreement|https://fcw.com/articles/2019/10/04/cloud-act-uk-deal-johnson.aspx]]|CLOUD_Act|
|2019.10.04|IT World Canada|[[Using the Cloud Securely: A conversation between two cybersecurity leaders|https://www.itworldcanada.com/sponsored/using-the-cloud-securely-a-conversation-between-two-cybersecurity-leaders]] ([[podcast .mp3|https://i.itworldcanada.com/wp-content/uploads/2019/10/Box-Audio-Mixdown-1.mp3]])|Misc|
|2019.10.04|SecureCloudBlog|[[Azure AD – Add Custom claims for WS-Federation applications|https://securecloud.blog/2019/10/03/azure-ad-add-custom-claims-for-ws-federation-applications/]]|AzureAD|
|2019.10.04|//Risk Recon//|[[5 Risk Factors for Deciding Where to Host Cloud-Eligible Assets|https://blog.riskrecon.com/5-risk-factors-for-deciding-where-to-host-cloud-eligible-assets]]|Risks Hosting|
|2019.10.04|DevOps.com|[[ESG Survey Sees Long DevSecOps Road Ahead|https://devops.com/esg-survey-sees-long-devsecops-road-ahead/]]|Report ESG|
|>|>|>|!2019.10.03|
|2019.10.03|Reuters|[[France recruits Dassault Systemes, OVH for alternative to U.S. cloud firms|https://www.reuters.com/article/us-france-dataprotection/france-recruits-dassault-systemes-ovh-for-alternative-to-u-s-cloud-firms-idUSKBN1WI189]]|Sovereign_Cloud|
|2019.10.03|Silicon.fr[>img[iCSF/flag_fr.png]]| → [[Cloud souverain : Bruno Lemaire relance Dassault Systèmes et OVH|https://www.silicon.fr/cloud-souverain-bruno-lemaire-relance-dassault-systemes-et-ovh-262679.html]]|Sovereign_Cloud|
|2019.10.03|DZone|![[How To Avoid Data Breaches In The Cloud|https://dzone.com/articles/how-to-avoid-data-breaches-in-the-cloud]]|Data_Breaches|
|2019.10.03|GovLoop|[[Survey Findings: The State of Cloud Adoption|https://www.govloop.com/survey-findings-the-state-of-cloud-adoption/]]|Survey|
|2019.10.03|The Register|[[Are your Office 365 biz accounts secure? Don't find out the hard way... There are tools to keep staff, customers safe|https://www.theregister.co.uk/2019/10/03/office_365_security_compliance/]]|O365 Compliance|
|2019.10.03|Bleeping Computer|[[Office 365 Admins Can Now Block Malicious Microsoft Query IQY Files|https://www.bleepingcomputer.com/news/microsoft/office-365-admins-can-now-block-malicious-microsoft-query-iqy-files/]]|O365|
|2019.10.02|//Microsoft Azure//|[[All your creds are belong to us!|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/All-your-creds-are-belong-to-us/ba-p/855124]]|Authentication|
|2019.10.03|//Fugue//|[[Cloud Security Posture Management: Benefits and Uses|https://www.fugue.co/blog/cloud-security-posture-management-benefits-and-uses]]|Security_Posture Misconfigurations|
|2019.10.03|//Managed Methods//|[[Where Cloud Security Fits In Your Cybersecurity Infrastructure|https://managedmethods.com/blog/cybersecurity-infrastructure-cloud-security/]]|Infrastructure|
|2019.10.03|//ThreatStack//|[[Cloud Security Professional Development & Educational Resource Roundup|https://www.threatstack.com/blog/cloud-security-professional-development-educational-resource-roundup]]|Education|
|2019.10.03|//Google//|[[4 steps to stop data exfiltration with Google Cloud|https://cloud.google.com/blog/products/identity-security/4-steps-to-stop-data-exfiltration-with-google-cloud]] (5/6)|GCP Exfiltration|
|2019.10.03|//Google//|[[Take time for discovery and assessment - and consider a partner - for a successful cloud migration|https://cloud.google.com/blog/products/cloud-migration/take-time-for-discovery-and-assessment-and-consider-a-partner-for-a-successful-cloud-migration]]|Migration|
|2019.10.03|//AWS//|[[Amazon Elasticsearch Service provides option to mandate HTTPS|https://aws.amazon.com/about-aws/whats-new/2019/10/amazon-elasticsearch-service-provides-option-to-mandate-https/]] ([[details|https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-data-protection.html]])|AWS|
|2019.10.03|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Un Office 365 sécurisé, une perle rare ?|https://www.riskinsight-wavestone.com/2019/10/office-365/]]|O365|
|>|>|>|!2019.10.02|
|2019.10.02|Les Echos[>img[iCSF/flag_fr.png]]|[[Cloud Act : halte à la désinformation !|https://www.lesechos.fr/idees-debats/cercle/cloud-act-halte-a-la-desinformation-140599]]|CLOUD_Act|
|2019.10.02|Dark Reading|[[Controlling Data Leakage in Cloud Test-Dev Environments|https://www.darkreading.com/cloud/controlling-data-leakage-in-cloud-test-dev-environments/a/d-id/1335909]]|Data_Leaks|
|2019.10.02|TechTarget|[[Healthcare cybersecurity threatened by cloud misconfigurations|https://searchhealthit.techtarget.com/news/252471750/Healthcare-cybersecurity-threatened-by-cloud-misconfigurations]]|Misconfigurations|
|2019.10.02|DZone|[[Overview of AWS Security Tools and Processes|https://dzone.com/articles/aws-overview-of-security-processes]]|AWS|
|2019.10.02|CyberDefense Mag|[[Cloud Security Essentials - Session Monitoring|https://www.cyberdefensemagazine.com/cloud-security-essentials/]]|Monitoring|
|2019.10.02|CyberDefense Mag|[[Why Zero Trust is the Right Security Model for the Cloud|https://www.cyberdefensemagazine.com/why-zero-trust-is-the-right-security-model-for-the-cloud/]]|Zero_Trust|
|2019.10.02|//Microsoft Azure//|![[Over 100 Azure services support PROTECTED Australian government data|https://azure.microsoft.com/en-us/blog/over-100-azure-services-support-protected-australian-government-data/]]|Azure Government Australia|
|2019.10.02|//Microsoft Azure//| → [[Australia specific assessment and compliance reports, FAQs and White Papers|https://servicetrust.microsoft.com/viewpage/AustraliaV3]]|Azure Government Australia|
|2019.10.02|//Microsoft Azure//| → [[2019 Microsoft Azure IRAP (Information Security Registered Assessor Program) Assessment Report|https://servicetrust.microsoft.com/viewpage/AustraliaV3?command=Download&downloadType=Document&downloadId=ffcb3aeb-475e-4f23-8a8f-2fc7dac18d68&tab=d1b1d320-3d79-11e9-9157-b7b7eba45f26&docTab=d1b1d320-3d79-11e9-9157-b7b7eba45f26_GRC_Assessment_Reports]]|Azure Government Australia|
|2019.10.02|//Box//|[[Box debuts new security controls, other enhancements to workflow automation tools|https://siliconangle.com/2019/10/02/box-debuts-new-security-controls-enhancements-workflow-automation-tools/]]|Box|
|2019.10.02|//Google//[>img[iCSF/flag_fr.png]]|[[Eric Haddad, Google Cloud : nous mettons notre priorité sur la security-by-design et de privacy-by-design|http://www.globalsecuritymag.fr/Eric-Haddad-Google-Cloud-nous,20191003,91138.html]]|GCP Security_by_Design|
|2019.10.02|//Google//|[[Archive media for the long term with preservation masters|https://cloud.google.com/blog/products/storage-data-transfer/archive-media-for-the-long-term-with-preservation-masters]]|Storage|
|2019.10.02|//Fugue//|![[Zombie Cloud Infrastructure is a Major Security Risk|https://www.fugue.co/blog/zombie-cloud-infrastructure-is-a-major-security-risk]]|Risks Infrastructure Zombies|
|2019.10.02|//Security Intelligence//|[[6 Steps to Modernize Your On-Premises Identity and Access Management Architecture|https://securityintelligence.com/posts/6-steps-to-modernize-your-on-premises-identity-and-access-management-architecture/]]|IAM|
|2019.10.02|//Cyware//|[[Understanding and Preparing for Container security threats|https://cyware.com/news/understanding-and-preparing-for-container-security-threats-26031da9]]|Containers Threats|
|2019.10.02|//McAfee//|[[Security is Shifting to a Unified Cloud Edge|https://securingtomorrow.mcafee.com/business/cloud-security/security-is-shifting-to-a-unified-cloud-edge/]]|Misc|
|2019.10.02|Alexandre Blanc|[[A backup strategy against ransomwares and threats (part 2)|https://www.linkedin.com/pulse/backup-strategy-against-ransomwares-threats-part-2-alexandre/]] (2/3)|Backups Ransomware|
|>|>|>|!2019.10.01|
|2019.10.01|IT Word Canada|[[Canadian government data is getting cloudier, signaling a 'massive leap of faith' in public cloud, says Microsoft|https://www.itworldcanada.com/article/canadian-government-data-is-getting-cloudier-signaling-a-massive-leap-of-faith-in-public-cloud-says-microsoft/422307]]||
|2019.10.01|Trenches of IT|[[How I Passed the AWS Certified Security – Specialty|https://www.trenchesofit.com/2019/10/01/how-i-passed-aws-security/]]|Training AWS|
|2019.10.01|HelpNet Security|[[Managing and monitoring privileged access to cloud ecosystems|https://www.helpnetsecurity.com/2019/10/01/cloud-pam/]]|Access_Controls|
|2019.10.01|//Gigamon//|[[What Is a Private Cloud? Your Data with a Room of Its Own|https://blog.gigamon.com/2019/10/01/what-is-private-cloud-your-data-with-a-room-of-its-own/]]|Private_Cloud|
|2019.10.01|//ThreatStack//|[[The Top 3 Security Mistakes SaaS Companies are Making|https://www.threatstack.com/blog/the-top-3-security-mistakes-saas-companies-are-making]]|SaaS|
|2019.10.01|//JumpCloud//|[[Benefits of Cloud-Based RADIUS Servers|https://jumpcloud.com/blog/benefits-cloud-radius-servers/]]|Radius|
|2019.10.01|//JumpCloud//|[[Security-as-a-Service: IAM|https://jumpcloud.com/blog/secaas-iam/]]|IAM|
|2019.10.01|//Netwrix//|[[The Capital One Hack: 3 Questions about Data Security in the Cloud|https://blog.netwrix.com/2019/10/01/the-capital-one-hack-3-questions-about-data-security-in-the-cloud/]]|CapitalOne Lessons_Learnt|
|2019.10.01|Alexandre Blanc|[[A backup strategy against ransomwares and threats (part 1)|https://www.linkedin.com/pulse/backup-strategy-against-ransomwares-threats-part-1-alexandre/]] (1/3)|Backups Ransomware|
|!Septembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.09.30|
|2019.09.30|Container Journal|![[PaaS vs. KaaS: A Primer|https://containerjournal.com/topics/container-ecosystems/paas-vs-kaas-a-primer/]]|
|2019.09.30|Helpnet Security|[[DevSecOps is emerging as the main methodology for securing cloud-native applications|https://www.helpnetsecurity.com/2019/09/30/securing-cloud-native-applications/]]|DevSecOps|
|2019.09.30|KitPloit|[[Terraform AWS Secure Baseline|https://www.kitploit.com/2019/09/terraform-aws-secure-baseline-terraform.html]]|Tools AWS Terraform|
|2019.09.30|ZDnet|[[Docker is in deep trouble|https://www.zdnet.com/article/docker-is-in-deep-trouble/]]|Docker|
|2019.10.02|Informatique News[>img[iCSF/flag_fr.png]]|[[En difficulté, Docker cherche de nouveaux financements|ttps://www.informatiquenews.fr/en-difficulte-docker-cherche-de-nouveaux-financements-63772]]|Docker|
|2019.09.30|CyberSecurity Hub|[[Cloud Security: A CISO Guide|https://www.cshub.com/cloud/articles/cloud-security-a-ciso-guide]]|Risks|
|2019.09.30|JDSupra|[[Luxembourg Cloud computing rules for investment fund managers: a reminder of the obligations 6 months before their Cloud Register must be drawn up|https://www.jdsupra.com/legalnews/luxembourg-cloud-computing-rules-for-47103/]]|Luxembourg|
|2019.10.02|Global Security Mag[>img[iCSF/flag_fr.png]]|[[Selon l'Insight Intelligent Technology Index 2019, Les services cloud inutilisés coûtent 9,6 millions d'euros aux entreprises|http://www.globalsecuritymag.fr/Selon-l-Insight-Intelligent,20190926,91105.html]]|Survey ITI|
|2019.09.30|Insight| → [[2019 Europe Index Intelligent Technology™ d'Insight|https://fr.insight.com/content/dam/insight-web/en_GB/images/2019/09/index-intelligent-technology-insight-france.pdf]]|Report|
|2019.09.30|//Google//|[[Detect and respond to high-risk threats in your logs with Google Cloud|https://cloud.google.com/blog/products/identity-security/detect-and-respond-to-high-risk-threats-in-your-logs-with-google-cloud]] (4/6)|GCP Threats Detection|
|2019.09.30|//Rapid7//|[[You Can Have It Both Ways with AppSec: Security and Speed|https://blog.rapid7.com/2019/09/30/you-can-have-it-both-ways-with-appsec-security-and-speed/]]|SAST DAST|
|2019.09.30|//Spanning//|[[Why Multi-Factor Authentication (MFA) Is a Must-Have in the Microsoft World and Beyond|https://spanning.com/blog/why-multi-factor-authentication-is-a-must-have/]]|O365 MFA|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Octobre 2019]]>>
!"//Guidelines for CPAs Providing CSA STAR Attestation v2//"
Document annoncé comme publié le 20 septembre 2019, mais daté du 27 septembre 2019 et mis en ligne le 3 octobre 2019.
<<<
[>img(200px,auto)[iCSA/J9KAG.png]]//This document provides guidance for CPAs in conducting a STAR Attestation. This document is not meant to replace any American Institute of Certified Public Accountant (AICPA) Standards or AICPA Service Organization Control® (SOC) related guidance. Refer to [[aicpa.org/soc|http://www.aicpa.org/soc]] for information about SOC and how to obtain SOC related standards and guidance.//
<<<
__Table des matières :__
<<<
* Part 1 – Professional Requirements
## General
## Requirements for engagement performance
## Competency requirements
## Scope of Attestation
## Criteria establishment and selection
* Part 2 – Additional CSA Guidelines
## CSA Competency
## Scope
## Submitting materials to CSA
<<<
&rArr; ''[[CloudSecurityAlliance.fr/go/ja4s/|https://CloudSecurityAlliance.fr/go/ja4s/]]
!"//Why you can't have backdoored crypto that is secure//"
[>img(150px,auto)[iCSA/JA3BW.jpg]]Article de blog publié le 3 octobre 2019 — Rédigé par Kurt Seifried, Chief Blockchain Officer, CSA
<<<
//So as you have probably seen some parts of the US government are again making noise about end-to-end encryption.

We've seen this before (clipper chip, key escrow, etc., etc.). The new twist is that they appear to be trying a thin end of the wedge approach, banning end-to-end encryption in consumer applications (like Whatsapp, Signal and so on) but large corporations will be allowed to have end-to-end encryption to protect their systems. 

Let's ignore the whole consumer vs. corporate argument for a minute (does the CSA qualify? Would we be allowed to have internally secure communications? What about small and medium businesses? What about people who are self-employed?). 

So in order to be effective against an attacker that steals your laptop or cell phone, the encryption system also needs to be effective against a nation-state that takes (e.g. at the border, legally) your laptop or cell phone. Is this a lawful matter with a warrant and judicial transparency? Or is this part of a widespread crackdown by a repressive regime on pro-democracy supporters? Security can either be controlled by the end-user(s) involved in some specific communication/data processing, or it can also be controlled by some third party (e.g., the data processing platform). If a third party is involved, then that third party can choose to reveal the data without consent or even knowledge in most cases of the end parties, due to a lawful warrant, or because they decided to monetize your data and sell it to advertisers. Once you lose technical control of your encryption and privacy you are at risk of a number of attacks, ranging from bribery and theft from the third party to that third party going bankrupt and your data assets being auctioned off to the highest bidder. 

This is why the CSA is actively exploring and engineering Blockchain solutions that involve end-to-end privacy and technical controls that are placed in the hands of the end-users, because anything less is just a data breach away from failure.//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/ja3b/]] sur le blog de la CSA.
[img(25%,1px)[iCSF/BluePixel.gif]]
Un appel à commentaires dont la date de clôture est le ''3 novembre 2019'' : "''Critical Controls Implementation for SAP''".
<<<
//The Critical Controls Implementation for SAP is the first in a series of implementation documents that the CSA ERP Security Working Group aims to develop. These documents will focus on specific ERP technologies, starting with SAP. The Critical Controls Implementation for SAP document will be released in 2 parts. Part 1 will feature the first 10 controls with the second part featuring the rest at a later date. The document takes a technical and granular approach including information such as implementation checklists and SAP transaction numbers.//
<<<
__Extrait :__
<<<
The Critical Controls Implementation for SAP is the first document in a series of implementation documents we hope to develop that focuses on specific ERP technologies. The documents will be released in 2 parts. The first part of the document will provide controls implementation guidance for the following controls:
* APP01 - Secure Landscape
* APP02 - Baseline Secure Configurations
* APP03 - Security Vulnerabilities
* INT01 – Secure Integrations and API
* DAT01 – Continuous Monitoring
* DAT02 – Data Separation
* DAT03 – Data Encryption
* BUS01 -  Inventory of Business Assets, Data and Processes
* BUS02 - Business Process Controls
* BUS03 - Continuous Compliance
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/ja3c/|https://cloudsecurityalliance.fr/go/ja3c/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(300px,auto)[iCSA/CCSK_cwet.jpg]]La [[Cloud Security Alliance]] annonce le lancement d'un forfait CCSK .
<<<
//__''CSA Announces Availability of Certificate of Cloud Security Knowledge Foundation Exam Bundle''__
Exam bundle makes it even easier to demonstrate knowledge in key areas of cloud security

SEATTLE – October 3, 2019 – The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today announced the availability of the Certificate of Cloud Security Knowledge (CCSK) Foundation Exam bundle. Now, those looking to demonstrate their competency in key cloud security areas such as governance and compliance can take the ''CCSK Foundation'' self-paced online course and receive an exam token for just $795 (a $890 value).

"There is a tremendous skills gap facing modern enterprises today, and cost shouldn't be an impediment to furthering one's career in a high-growth field with a rising demand for security professionals who can demonstrate a deep knowledge of cloud security," said Ryan Bergsma. "We're proud to be able to provide today'sinfosec leaders with an affordable option to advancement."

After purchasing the ''CCSK Foundation'' Exam bundle, students will be able to access the training for 60 days (with an automatic 30-day extension on request and further extensions at CSA's discretion). Tokens are valid for two years and include two attempts. The bundle includes seven modules:
# ''CCSK Foundation'' Introduction.
** A preview of the ''CSA CCSK Foundation Course'' content and class structure, along with the study materials that will be used throughout the course.
# Cloud Architecture.
** The fundamentals of cloud computing, including definitions, architectures, and the role of virtualization. Key topics include fundamental characteristics, cloud service and delivery models, and the Shared Responsibilities Model.
# Infrastructure Security for Cloud.
** Core infrastructure security- including networks, management interfaces, and administrator credentials. Students will also learn about virtual networking and workload security, including the basics of containers and serverless.
# Managing Cloud Security and Risk.
** Considerations and tools for risk assessment, governance, legal issues and compliance. Students will learn important considerations for managing security for cloud computing and be introduced to important CSA risk tools.
# Data Security for Cloud.
** Data security lifecycle, cloud storage models, data security issues and managing encryption. This module covers information lifecycle management for the cloud and how to apply security controls, with an emphasis on public cloud.
# Securing Cloud Applications, Users and Related Technologies.
** Identity management and application security for cloud deployments. Topics in this module include federated identity and different IAM applications, secure development, and managing application security in and for the cloud.
# Cloud Security Operations.
** Evaluating, selecting, and managing cloud computing providers. This module also discusses the role of Security as a Service providers and the impact of cloud on incident response.

The vendor-neutral CCSK tests for a broad foundation of cloud security knowledge, covering such topics as architecture, governance, compliance, operations, encryption, and virtualization. The CCSK exam body of knowledge is the CSA Security Guidance v4, the CSA Cloud Control Matrix and the ENISA Cloud Computing Risk Assessment report. Those interested in taking the exam can also choose to take advantage of a variety of CCSK training programs, including free self-study prep courses, in-person training sessions, and instructor-led online classes. Since it was launched in 2010, thousands of IT and security professionals have upgraded their skillsets and enhanced their careers by obtaining the CCSK.//
<<<
[img(25%,1px)[iCSF/BluePixel.gif]]
* Lien → ''[[CloudSecurityAlliance.fr/go/ja3a/|https://cloudsecurityalliance.fr/go/ja3a/]]''
* Le forfait est décrit [[ici|2019.10.03 - Actu : Forfait CCSK 'Foundation Exam Bundle']].
[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(100px,auto)[iCSA/CCSK_cwet.jpg]]Le forfait "''Foundation Exam Bundle''" comprend la formation en ligne pour les 7 modules et un jeton pour passer l'examen.
<<<
//Teaches the fundamentals of cloud security including: architecture, data security, managing risk and more. This course comes with a test token for students to take the CCSK exam.

* [>img(100px,auto)[iCSA/CCSK_0.jpg]]''Introduction: CCSK Foundation Introduction''
** Introduction to the CSA CCSK Foundation Course content and class structure. During this module you will be introduced to your instructor, Rich Mogull and familiarize yourself with the study materials you'll be using throughout the course. 

* [>img(100px,auto)[iCSA/CCSK_1.jpg]]''Module 1: Cloud Architecture''
** The fundamentals of cloud computing, including definitions, architectures, and the role of virtualization. Key topics include fundamental characteristics, cloud service and delivery models, and the Shared Responsibilities Model. 

* [>img(100px,auto)[iCSA/CCSK_2.jpg]]''Module 2: Infrastructure Security for Cloud''
** Core infrastructure security- including networks, management interfaces, and administrator credentials. Students will also learn about virtual networking and workload security, including the basics of containers and serverless. 

* [>img(100px,auto)[iCSA/CCSK_3.jpg]]''Module 3: Managing Cloud Security and Risk''
** Considerations and tools for risk assessment, governance, legal issues and compliance. Students will learn important considerations for managing security for cloud computing and be introduced to important CSA risk tools. 

* [>img(100px,auto)[iCSA/CCSK_4.jpg]]''Module 4: Data Security For Cloud''
** Data security lifecycle, cloud storage models, data security issues and managing encryption. This module covers information lifecycle management for the cloud and how to apply security controls, with an emphasis on public cloud. 

* [>img(100px,auto)[iCSA/CCSK_5.jpg]]''Module 5: Securing Cloud Applications, Users and Related Technologies''
** Identity management and application security for cloud deployments. Topics in this module include federated identity and different IAM applications, secure development, and managing application security in and for the cloud. 

* [>img(100px,auto)[iCSA/CCSK_6.jpg]]''Module 6: Cloud Security Operations''
** Evaluating, selecting, and managing cloud computing providers. This module also discusses the role of Security as a Service providers and the impact of cloud on incident response. 
//
<<<
[img(25%,1px)[iCSF/BluePixel.gif]]
* Lien → * Lien → ''[[CloudSecurityAlliance.fr/go/ja3k/|https://cloudsecurityalliance.fr/go/ja3k/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Guardians of the Cloud: The Latest Security Findings//"
[>img(100px,auto)[iCSA/JA7BG.jpg]]^^Bien que publié le 7 octobre 2019 sur le blog de la CSA, cet article l'a déjà été il y a presque 3 mois, le 17 juillet 2019 sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/ja7z/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/ja7x/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//What to Expect at the 2019 Colorado Chapter Forum//"
[>img(100px,auto)[iCSA/JA2BW.jpg]]^^Annonce de la réunion du chapitre du Colorado et de son programme. Elle se tiendra le jeudi 7 novembre 2019 à Denver, et sera suivie d'une formation CCSK le lendemain.
&rArr; Lire [[l'article|https://blog.cloudsecurityalliance.org/2019/10/02/what-to-expect-at-the-2019-colorado-chapter-forum/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Cloud Security Posture Management: Why You Need It Now//"
[>img(100px,auto)[iCSA/JA1BC.jpg]]^^Bien que publié le 1er octobre 2019 sur le blog de la CSA, cet article l'a déjà été il y a 2 mois, le 5 août 2019 sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/ja1z/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/ja1x/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201909>>
<<tiddler fAll2Tabs10 with: VeilleM","_201909>>
|!Septembre|!Sources|!Titres et Liens|!Keywords|
|2019.05.30|!MITRE|[[CVE-2019-12491|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12491]]: ^^OnApp allows an attacker to run arbitrary commands with root privileges on servers managed by OnApp for XEN/KVM hypervisors^^|OnApp CVE-2019-12491|
|2019.06.07|//OnApp//|[[OnApp General Security Advisory|https://docs.onapp.com/rn/general-security-advisory]]|CVE-2019-12491 OnApp|
|2019.09.26|//Skylight//|[[All Your Cloud Are Belong To Us (CVE-2019-12491)|https://skylightcyber.com/2019/09/26/all-your-cloud-are-belong-to-us-cve-2019-12491/]]|CVE-2019-12491 OnApp|
|2019.09.26|MotherBoard| → [[Thousands of Cloud Computing Servers Could Be Owned With 'Very Simple' Attack, Researchers Say|https://www.vice.com/en_us/article/ywanev/thousands-of-cloud-computing-servers-could-be-owned-with-very-simple-attack-researchers-say]]|CVE-2019-12491 OnApp|
|2019.09.26|Dark Reading| → [[Cloud Vulnerability Could Let One Server Compromise Thousands|https://www.darkreading.com/cloud/cloud-vulnerability-could-let-one-server-compromise-thousands/d/d-id/1335943]]|CVE-2019-12491 OnApp|
|>|>|>|!|
|2019.09.08|!MITRE|[[CVE-2019-16097|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16097]]: ^^core/api/user.go [...] allows non-admin users to create admin accounts via the POST /api/users API^^|Harbor CVE-2019-16097|
|2019.09.18|//PaloAlto Networks//|[[Critical Vulnerability in Harbor Enables Privilege Escalation from Zero to Admin (CVE-2019-16097)|https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/]]|Harbor CVE-2019-16097|
|2019.09.19|Bleeping Computer| → [[Critical Bug In Harbor Container Registry Gives Admin Access|https://www.bleepingcomputer.com/news/security/critical-bug-in-harbor-container-registry-gives-admin-access/]]|Harbor CVE-2019-16097|
|2019.09.20|GBHackers on Security| → [[Critical Vulnerability in Harbor let Hackers to Escalate Privilege by Sending Malicious Request|https://gbhackers.com/critical-vulnerability-harbor/]]|Harbor CVE-2019-16097|
|2019.09.02|Harbor|[[Disallow creating an admin user when registration #8917|https://github.com/goharbor/harbor/pull/8917]]|CVE-2019-16097 Patch|
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Septembre 2019]]>>
<<tiddler fAll2LiTabs with: NewsL","201909>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Septembre 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Septembre 2019]]>><<tiddler fAll2LiTabs with: Actu","201909>>
<<tiddler fAll2LiTabs with: Blog","201909>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Septembre 2019]]>>
<<tiddler fAll2LiTabs with: Publ","201909>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Septembre 2019]]>>
!1 - Les nouveautés CSA de la semaine du 23 au 29 septembre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Actu : Il ne reste plus que 3 jours pour commenter la traduction en français de 3 documents CSA+++*[»]> <<tiddler [[2019.09.19 - Actu : Demande de validation la traduction en français de 3 documents CSA]]>>=== 
* Blog : ''How Blockchain Might Save Us All''+++*[»]> <<tiddler [[2019.09.27 - Blog : 'How Blockchain Might Save Us All']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.09.29 - Veille Hebdomadaire]] avec une soixantaine de liens :
* __''À lire'' :__ Démarche ayant amené Amazon a renforcer la sécurité de ses buckets S3+++*[»]> 
|2019.09.23|HelpNet Security|![[How data breaches forced Amazon to update S3 bucket security|https://www.helpnetsecurity.com/2019/09/23/s3-bucket-security/]]|AWS S3|
=== 
* __''À lire'' :__ Recommandations sécurité sur Office 365 de l'Agence nationale de Cyber Sécurité finlandaise+++*[»]> 
|2019.09.23|NCSC-FI|![[Protection against Microsoft Office 365 credential phishing and data breaches|https://www.kyberturvallisuuskeskus.fi/en/ohjeet]] ([[guide .pdf|https://www.kyberturvallisuuskeskus.fi/sites/default/files/media/publication/T_MS365_eng_200919.pdf]])|O365 Best_Practices|
|2019.09.23|Bleeping Computer| → [[Finnish Govt. Releases Guide on Securing Microsoft Office 365|https://www.bleepingcomputer.com/news/security/finnish-govt-releases-guide-on-securing-microsoft-office-365/]]|O365 Best_Practices|
=== 
* Alerte : CVE-2019-12491 affectant ''OnApp'' la plate-forme d'orchestration utilisée par de très nombreux prestataires Cloud+++*[»]> <<tiddler [[2019.09.30 - Alertes]]>>=== 
* Rapports et sondages : "''Cloud-Native Breaches''" (ESG)+++*[»]> 
|2019.09.24|//ESG//|[[You Might Be Cloud-First, But Security Is Still an Afterthought|https://www.businesswire.com/news/home/20190924005500/en/Cloud-First-Security-Afterthought]]|Report ESG DevSecOps|
|2019.09.24|//Capsule8//| → [[Retooling CyberSecurity Programs for the Cloud-first Era|https://info.capsule8.com/retooling-cybersecurity-programs-for-the-cloud]]|Report ESG DevSecOps|
|2019.09.24|DevOps.com| → [[DevSecOps Becomes a Higher Cloud-Native Priority|https://devops.com/devsecops-becomes-a-higher-cloud-native-priority/]]|Report ESG DevSecOps|
|2019.09.25|HelpNet Security| → [[Security capabilities are lagging behind cloud adoption|https://www.helpnetsecurity.com/2019/09/25/security-capabilities-cloud-adoption/]]|Report ESG DevSecOps|
===, "''Cloud-Native Breaches''" (McAfee)+++*[»]> 
|2019.09.24|//McAfee//|[[McAfee Report Demonstrates Cloud-Native Breaches Differ Greatly From Malware Attacks of the Past|https://www.businesswire.com/news/home/20190924005213/en/McAfee-Report-Demonstrates-Cloud-Native-Breaches-Differ-Greatly]]|Report McAfee|
|2019.09.24|//McAfee//| → [[Cloud-Native: The Infrastructure-as-a-Service (IaaS) Adoption and Risk Report|https://www.mcafee.com/enterprise/en-us/forms/gated-form.html?docID=be66d487-f531-4484-ba0c-558b534ff779&esheet=52099611&newsitemid=20190924005213]]|Report McAfee|
|2019.09.24|Dark Reading| → [[Cloud-Native Breaches Differ Greatly from Malware Attacks of the Past: McAfee Report|https://www.darkreading.com/cloud/cloud-native-breaches-differ-greatly-from-malware-attacks-of-the-past-mcafee-report/d/d-id/1335890]]|Report McAfee|
|2019.09.24|HelpNet Security| → [[99% of misconfiguration incidents in the cloud go unnoticed|https://www.helpnetsecurity.com/2019/09/25/cloud-misconfiguration-incidents/]]|Report McAfee|
=== 
* Offres produits : annonce Microsoft d'Azure Sentinel+++*[»]> 
|2019.09.25|//Microsoft Azure//|[[Azure Sentinel - the cloud-native SIEM that empowers defenders is now generally available|https://www.microsoft.com/security/blog/2019/09/24/azure-sentinel-cloud-native-siem-empowers-defenders-generally-available/]]|Azure SIEM|
=== 
!3 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|>|>|>|!Alerte|
|2019.09.08|MITRE|[[CVE-2019-12491|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12491]]: ^^OnApp allows an attacker to run arbitrary commands with root privileges on servers managed by OnApp for XEN/KVM hypervisors^^|OnApp CVE-2019-12491|
|2019.09.26|//Skylight//|[[All Your Cloud Are Belong To Us (CVE-2019-12491)|https://skylightcyber.com/2019/09/26/all-your-cloud-are-belong-to-us-cve-2019-12491/]]
 → Voir ci-dessous|CVE-2019-12491 OnApp| |>|>|>|!| |>|>|>|| |!Septembre|!Sources|!Titres et Liens|!Keywords| |>|>|>|!2019.09.29| |2019.09.29|Christophe Parisel|![[An overview of security postures in Azure and AWS|https://www.linkedin.com/pulse/overview-security-postures-azure-aws-christophe-parisel/]]|Security_Posture Azure AWS| |2019.09.29|Forbes|[[New Cybersecurity Companies Have Their Heads In The Cloud|https://www.forbes.com/sites/jonmarkman/2019/09/29/new-cybersecurity-companies-have-their-heads-in-the-cloud/]]|Misc| |2019.09.29|//DivvyCloud//|[[Securing Your Cloud to Support Successful Mergers & Acquisitions|https://divvycloud.com/blog/cloud-security-mergers-acquisitions/]]|Misc| |>|>|>|!2019.09.28| |2019.09.28|Cyber Defense Mag|[[Why Cyber Security is Redefining SMEs' Business Operations on the Cloud|https://www.cyberdefensemagazine.com/why-cyber-security/]]|SMEs| |>|>|>|!2019.09.27| |2019.09.27|Bleeping Computer|[[Office 365 to Get Automated Incident Response for Hacked Accounts|https://www.bleepingcomputer.com/news/microsoft/office-365-to-get-automated-incident-response-for-hacked-accounts/]]|O365 automation Incidents| |2019.09.27|Security Boulevard|[[A Seismic Shift for Decrypted Visibility in the Cloud|https://securityboulevard.com/2019/09/a-seismic-shift-for-decrypted-visibility-in-the-cloud/]]|Encryption| |2019.09.27|//MarketResearch//[>img[iCSF/flag_fr.png]]|[[Le marché mondial des services de sécurité basés sur le cloud devrait gagner en popularité dans le monde entier d'ici 2025|https://www.loftvpro.com/le-marche-mondial-des-services-de-securite-bases-sur-le-cloud-devrait-gagner-en-popularite-dans-le-monde-entier-dici-2025/]]|Market| |2019.09.27|//Veracode//|[[Live From Gartner Security & Risk Mgmt Summit: How to Approach Container Security|https://www.veracode.com/blog/security-news/live-gartner-security-risk-mgmt-summit-how-approach-container-security]]|Containers| |2019.09.27|//BlueCat//|[[How to start achieving visibility in the cloud|https://www.helpnetsecurity.com/2019/09/27/visibility-in-the-cloud/]]|Visibility| |2019.09.27|//Oracle//|[[Multicloud is the New On-Prem|https://www.linkedin.com/pulse/multicloud-new-on-prem-matthew-o-keefe-ph-d-/]]|Multi_Cloud| |>|>|>|!2019.09.26| |2019.09.26|Solutions Numériques[>img[iCSF/flag_fr.png]]|[[IAM/IDaaS, la clé d'une approche "Zero Trust"|https://www.solutions-numeriques.com/dossiers/iam-idaas-la-cle-dune-approche-zero-trust/]]|IAM IDaaS| |2019.09.26|Cyber Defense Mag|[[Escaping the Gravitational Pull of Data Insecurity|https://www.cyberdefensemagazine.com/escaping-the-gravitational/]]|Data Regulations| |2019.09.26|//Skylight//|![[All Your Cloud Are Belong To Us (CVE-2019-12491)|https://skylightcyber.com/2019/09/26/all-your-cloud-are-belong-to-us-cve-2019-12491/]]|CVE-2019-12491 OnApp| |2019.09.26|MotherBoard| → [[Thousands of Cloud Computing Servers Could Be Owned With 'Very Simple' Attack, Researchers Say|https://www.vice.com/en_us/article/ywanev/thousands-of-cloud-computing-servers-could-be-owned-with-very-simple-attack-researchers-say]]|CVE-2019-12491 OnApp| |2019.09.26|Dark Reading| → [[Cloud Vulnerability Could Let One Server Compromise Thousands|https://www.darkreading.com/cloud/cloud-vulnerability-could-let-one-server-compromise-thousands/d/d-id/1335943]]|CVE-2019-12491 OnApp| |2019.09.26|Dark Reading|[[Why You Need to Think About API Security|https://www.darkreading.com/application-security/why-you-need-to-think-about-api-security/a/d-id/1335861]]|APIs| |2019.09.26|Dark Reading|[[Why Clouds Keep Leaking Data|https://www.darkreading.com/edge/theedge/why-clouds-keep-leaking-data/b/d-id/1335921]]|Data_Leaks CSA| |2019.09.26|KitSploit|[[Kube-Alien - Tool To Launches Attack on K8s Cluster from Within|https://www.kitploit.com/2019/09/kube-alien-tool-to-launches-attack-on.html]]|[[Tools|Outils-GitHub]]| |2019.09.26|//Zscaler//|[[Phishing attacks abusing appspot.com and web.app domains on Google Cloud|https://www.zscaler.com/blogs/research/phishing-attacks-abusing-appspotcom-and-webapp-domains-google-cloud]]|Phishing GCP| |2019.09.26|//CloudCheckr//|[[Understanding the Shared Responsibility Model for Cloud Security|https://cloudcheckr.com/cloud-security/shared-responsibility-model/]]|Shared_Responsibility| |2019.09.26|//DivvyCloud//|[[Lion Air Data Breach! Another Misconfigured S3 Bucket|https://divvycloud.com/blog/lion-air-data-breach-another-misconfigured-s3-bucket/]]|Data_Leak AWS_S3 Malindo| |2019.09.26|//Threatpost//|[[CISOs: Support Vendor Security Ops for Best Cloud Results|https://threatpost.com/cisos-support-vendor-security-ops-for-best-cloud-results/148665/]]|SaaS Survey McKinsey| |2019.09.26|//Microsoft Azure//|[[How to prevent phishing attacks that target your customers with DMARC and Office 365|https://www.microsoft.com/security/blog/2019/09/26/how-to-prevent-phishing-attacks-dmarc-office-365/]]|O365 Phishing Prevention| |2019.09.26|//WeScale//[>img[iCSF/flag_fr.png]]|![[Le guide de Chaos Engineering : Partie 1|https://blog.wescale.fr/2019/09/26/le-guide-de-chaos-engineering-part-1/]] (1/3)|Chaos_Engineering| |2019.09.26|//StackRox//|![[12 Kubernetes configuration best practices|https://www.stackrox.com/post/2019/09/12-kubernetes-configuration-best-practices/]]|Kubernetes Best_Practices| |2019.09.26|BuildAzure|[[Security of Azure Container Registry Image Promotion Flow|https://buildazure.com/security-azure-container-registry-image-promotion/]]|Azure Registry| |>|>|>|!2019.09.25| |2019.09.25|Bleeping Computer|[[Microsoft Phishing Attack Uses Google Redirects to Evade Detection|https://www.bleepingcomputer.com/news/security/microsoft-phishing-attack-uses-google-redirects-to-evade-detection/]]|O365 Phishing| |2019.09.25|FedScoop|[[Energy is using cyber risk assessments to make cloud decisions|https://www.fedscoop.com/energy-cyber-risk-cloud-budgeting/]]|Risk_Management FAIR| |2019.09.25|Cybersecurity Insiders|[[CCSP and CCSK: Which Cloud Security Credential Is Right For You?|https://www.cybersecurity-insiders.com/ccsp-and-ccsk-which-cloud-security-credential-is-right-for-you/]]|CCSK| |2019.09.25|BetaNews|[[How to use Windows 10's Cloud Download recovery feature|https://betanews.com/2019/09/25/windows-10-cloud-download/]]| |2019.09.25|Infosec Institute|[[CCSP exam and CBK changes in August|https://resources.infosecinstitute.com/ccsp-exam-and-cbk-changes-in-august/]]|Training| |2019.09.25|NextGov|[[How Federal Agencies Can Be More Proactive About Cloud Security|https://www.nextgov.com/ideas/2019/09/how-federal-agencies-can-be-more-proactive-about-cloud-security/160073/]]|Risks| |2019.09.25|TechradarPro|[[Choosing the right cloud container platform|https://www.techradar.com/news/choosing-the-right-cloud-container-platform]]|Containers| |2019.09.25|Channel Daily News|[[Who should the CISO report to, and other CloudSec 2019 takeaways|https://channeldailynews.com/news/who-should-the-ciso-report-to-and-other-cloudsec-2019-takeaways/68969]]|Misc| |2019.09.25|//Microsoft Azure//|[[Azure Sentinel - the cloud-native SIEM that empowers defenders is now generally available|https://www.microsoft.com/security/blog/2019/09/24/azure-sentinel-cloud-native-siem-empowers-defenders-generally-available/]]|Azure SIEM Sentinel| |2019.09.26|//Microsoft Azure//| → [[Azure Sentinel general availability: A modern SIEM reimagined in the cloud|https://azure.microsoft.com/en-us/blog/azure-sentinel-general-availability-a-modern-siem-reimagined-in-the-cloud/]]|Azure SIEM Sentinel| |2019.02.28|//Microsoft Azure//| → [[Announcing new cloud-based technology to empower cyber defenders|https://blogs.microsoft.com/blog/2019/02/28/announcing-new-cloud-based-technology-to-empower-cyber-defenders/]]|Azure SIEM Sentinel| |2019.09.25|//Microsoft Azure//|[[Top 5 use cases to help you make the most of your Cloud Access Security Broker|https://www.microsoft.com/security/blog/2019/09/25/top-5-use-cases-cloud-access-security-broker/]] (1/4)|CASB| |2019.02.25|//Microsoft Azure//|![[Ensuring secrecy orders are the exception not the rule when the government seeks data owned by our customers|https://blogs.microsoft.com/on-the-issues/2019/09/25/ensuring-secrecy-orders-are-the-exception-not-the-rule-when-the-government-seeks-data-owned-by-our-customers/]]|Regulations| |2019.09.26|Ars technica| → [[Microsoft: Customers are entitled to know about federal data requests|https://arstechnica.com/tech-policy/2019/09/microsoft-battles-feds-over-gag-orders-in-law-enforcement-data-requests/]]|Regulations| |2019.09.25|//Bitglass//|[[The Four Pillars of CASB: Identity|https://www.bitglass.com/blog/four-pillars-casb-identity]]|CASB| |2019.09.25|//Proofpoint//|[[Cloud Attacks Prove Effective Across Industries in the First Half of 2019|https://www.proofpoint.com/us/threat-insight/post/cloud-attacks-prove-effective-across-industries-first-half-2019]]|Report Proofpoint| |2019.09.25|UnderNews[>img[iCSF/flag_fr.png]]| → [[85 % des organisations ont subi au moins une cyberattaque via le cloud au cours du premier semestre 2019|https://www.undernews.fr/reseau-securite/85-des-organisations-ont-subi-au-moins-une-cyberattaque-via-le-cloud-au-cours-du-premier-semestre-2019.html]]|Report Proofpoint| |2019.09.25|//Markerbench//|[[Why CISOs should Care About Cloud "Drift"|http://www.markerbench.com/blog/2019/09/25/drifting-along/]]|Misc| |2019.09.25|//Puppet//|[[2019 State of DevOps Report|https://puppet.com/resources/whitepaper/state-of-devops-report]]|Report Puppet DevOps| |2019.09.25|//Puppet//|[[2019 State of DevOps Report Reveals Shifting Security Left is Insufficient; Organizations Must Fundamentally Change How They Work Earlier in the Software Delivery Cycle|https://www.globenewswire.com/news-release/2019/09/25/1920660/0/en/2019-State-of-DevOps-Report-Reveals-Shifting-Security-Left-is-Insufficient-Organizations-Must-Fundamentally-Change-How-They-Work-Earlier-in-the-Software-Delivery-Cycle.html]]|Report Puppet DevOps| |>|>|>|!2019.09.24| |2019.09.24|Cybersecurity Insiders|[[Why IaaS requires cloud security automation|https://www.cybersecurity-insiders.com/why-iaas-requires-cloud-security-automation/]]|IaaS Automation| |2019.09.24|Solutions Reviews|[[Cloud Compliance: How to Maintain Compliance in Your Cloud Deployment|https://solutionsreview.com/cloud-platforms/cloud-compliance-how-to-maintain-compliance-in-your-cloud-deployment/]]|Compliance| |2019.09.24|//ESG//|[[You Might Be Cloud-First, But Security Is Still an Afterthought|https://www.businesswire.com/news/home/20190924005500/en/Cloud-First-Security-Afterthought]]|Report ESG DevSecOps| |2019.09.24|//Capsule8//| → [[Retooling CyberSecurity Programs for the Cloud-first Era|https://info.capsule8.com/retooling-cybersecurity-programs-for-the-cloud]]|Report ESG DevSecOps| |2019.09.24|DevOps.com| → [[DevSecOps Becomes a Higher Cloud-Native Priority|https://devops.com/devsecops-becomes-a-higher-cloud-native-priority/]]|Report ESG DevSecOps| |2019.09.25|HelpNet Security| → [[Security capabilities are lagging behind cloud adoption|https://www.helpnetsecurity.com/2019/09/25/security-capabilities-cloud-adoption/]]|Report ESG DevSecOps| |2019.09.26|Dark Reading| → [[Cloud-Native Applications: Shift to Serverless is Underway|https://www.darkreading.com/cloud/cloud-native-applications-shift-to-serverless-is-underway/d/d-id/1335931]]|Report ESG DevSecOps| |2019.09.26|InfoSecurity Mag| → [[Secure DevOps Practices Expected to Increase for Cloud Apps|https://www.infosecurity-magazine.com/news/secure-devops-cloud-apps/]]|Report ESG DevSecOps| |2019.09.24|//McAfee//|[[McAfee Report Demonstrates Cloud-Native Breaches Differ Greatly From Malware Attacks of the Past|https://www.businesswire.com/news/home/20190924005213/en/McAfee-Report-Demonstrates-Cloud-Native-Breaches-Differ-Greatly]]|Report McAfee| |2019.09.24|//McAfee//| → [[Cloud-Native: The Infrastructure-as-a-Service (IaaS) Adoption and Risk Report|https://www.mcafee.com/enterprise/en-us/forms/gated-form.html?docID=be66d487-f531-4484-ba0c-558b534ff779&esheet=52099611&newsitemid=20190924005213]]|Report McAfee| |2019.09.24|Dark Reading| → [[Cloud-Native Breaches Differ Greatly from Malware Attacks of the Past: McAfee Report|https://www.darkreading.com/cloud/cloud-native-breaches-differ-greatly-from-malware-attacks-of-the-past-mcafee-report/d/d-id/1335890]]|Report McAfee| |2019.09.24|HelpNet Security| → [[99% of misconfiguration incidents in the cloud go unnoticed|https://www.helpnetsecurity.com/2019/09/25/cloud-misconfiguration-incidents/]]|Report McAfee| |2019.09.24|//PaloAlto Networks//|[[5 Considerations Before Building Your Own Cloud Security Tool|https://blog.paloaltonetworks.com/2019/09/cloud-security-tool/]]|Tools| |2019.09.24|//McAfee//|[[McAfee Cloud Adoption and Risk Report - Uncovering the scale of risk in the cloud|https://www.mcafee.com/enterprise/en-us/solutions/lp/cloud-adoption-risk.html]] ou [[ici|https://cloudsecurity.mcafee.com/cloud/en-us/forms/white-papers/wp-cloud-adoption-risk-report-2019-banner-cloud-mfe.html]]|Report McAfee| |2019.09.24|//Digital Shadows//|![[SecDevOps: Continued Database Exposures Point to Growing Challenges|https://www.digitalshadows.com/blog-and-research/secdevops-continued-database-exposures-point-to-growing-challenges/]]|SecDevOps BreachesData_| |2019.09.24|//Digital Shadows//| → [[Timeline of Inadvertant Data Breaches (2017-2019)|https://www.slideshare.net/digitalshadows/inadvertant-data-breaches]]|Data_Breaches| |2019.09.24|//Threatstack//|[[16 Kubernetes Experts Share the Most Interesting Current Trends to Look for in Kubernetes|https://www.threatstack.com/blog/16-kubernetes-experts-share-the-most-interesting-current-trends-to-look-for-in-kubernetes]]|Kubernetes Trends| |2019.09.24|//Pupuweb//|[[5 Essentials for Hybrid Identity Management and Security|https://pupuweb.com/essentials-hybrid-identity-management-security/]]|IAM| |2019.09.24|//Clever Cloud//[>img[iCSF/flag_fr.png]]|![[Le grand retour du "cloud souverain": une histoire de gouvernance et de protectionnisme|https://www.frenchweb.fr/le-grand-retour-du-cloud-souverain-une-histoire-de-gouvernance-et-de-protectionnisme/376626]]|Sovereign_Cloud| |2019.09.24|Dev.to|[[Best Practices for Event-Driven Microservice Architecture|https://dev.to/heroku/best-practices-for-event-driven-microservice-architecture-2lh7]]|Misc| |>|>|>|!2019.09.23| |2019.09.23|NCSC-FI|![[Protection against Microsoft Office 365 credential phishing and data breaches|https://www.kyberturvallisuuskeskus.fi/en/ohjeet]] ([[guide .pdf|https://www.kyberturvallisuuskeskus.fi/sites/default/files/media/publication/T_MS365_eng_200919.pdf]])|O365 Best_Practices| |2019.09.23|Bleeping Computer| → [[Finnish Govt. Releases Guide on Securing Microsoft Office 365|https://www.bleepingcomputer.com/news/security/finnish-govt-releases-guide-on-securing-microsoft-office-365/]]|O365 Best_Practices| |2019.09.23|HelpNet Security|![[How data breaches forced Amazon to update S3 bucket security|https://www.helpnetsecurity.com/2019/09/23/s3-bucket-security/]]|AWS S3| |2019.09.23|Container Journal|[[Harbor Container Registry Project Advances|https://containerjournal.com/topics/container-management/harbor-container-registry-project-advances/]]|Harbor| |2019.09.23|CloudTweaks|[[Implementing Serverless Microservices Architecture on AWS|https://cloudtweaks.com/2019/09/implementing-serverless-microservices-architecture/]]|Serverless| |2019.09.23|Finextra|[[Sibos 2019: Cloud services- huge burden of security responsibility|https://www.finextra.com/newsarticle/34457/sibos-2019-cloud-services--huge-burden-of-security-responsibility]]|Shared_Responsibility| |2019.09.23|Cybersecurity Insiders|[[Controlling Access Is a Key Component of Security for Hybrid IT|https://www.cybersecurity-insiders.com/controlling-access-is-a-key-component-of-security-for-hybrid-it/]]|Access_Controls| |2019.09.23|The Next Web|[[More than 60% of Ethereum nodes run in the cloud, mostly on Amazon Web Services|https://thenextweb.com/hardfork/2019/09/23/ethereum-nodes-cloud-services-amazon-web-services-blockchain-hosted-decentralization/]]|AWS Blockchain| |2019.09.23|//Microsoft Azure//|[[How to develop your service health alerting strategy|https://azure.microsoft.com/en-us/blog/how-to-develop-your-service-health-alerting-strategy/]]|Monitoring| |2019.09.23|//Clearswift//|[[Big brands don't guarantee big security: how to bolster your information security in the cloud|https://www.clearswift.com/blog/2019/09/23/big-brands-don%E2%80%99t-guarantee-big-security-how-bolster-your-information-security-cloud]]|Risks| |2019.09.23|//Qualys//|[[Empower your Cloud Ops Teams – Publish Qualys CloudView Security Assessment Reports to their Slack Channel|https://blog.qualys.com/news/2019/09/23/empower-your-cloud-ops-teams-publish-qualys-cloudview-security-assessment-reports-to-their-slack-channel]]|SecOps| |2019.09.23|//Arbor//|[[How Cybercrime-as-a-Service Is Growing the Black Market|https://www.armor.com/blog/how-cybercrime-as-a-service-is-growing-the-black-market/]]|Crimeware| <<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Septembre 2019]]>>
!"//How Blockchain Might Save Us All//"
[>img(150px,auto)[iCSA/J9RBH.jpg]]Article de blog publié le 27 septembre 2019 — Rédigé par Kurt Seifried, Chief Blockchain Officer, CSA
<<<
//I've been seeing a lot of articles claiming that Blockchain will save us from hackers, and ransomware, and all sorts of other Cyber-Shenanigans. So… will Blockchain save us all? Yes, well ... sort of, it's complicated.
Let's start with a story:

__''The evolution of web browsers''__
Web browsers. Through the 1990's and 2000's the web browser became a dominant piece of software. Through the late 2000's the dominance of JavaScript became obvious, with high speed Internet it became possible to deliver multi megabyte web pages (currently cnn.com is 1.4 megabytes, YoutTube is 1.9 and even the "lean" front page of google.com is 0.45). But the performance of running JavaScript in the web browser… well let's be honest. It was becoming awful. So awful in fact that it was beginning to impact Google, who wanted to deliver rich web pages and services using JavaScript, but… the experience was so slow and awful people were getting turned off of it. Now if you're the scale of Google the solution is simple: you engineer and release a really fast web browser with a really fast JavaScript engine (V8).
This has two main effects:
* It gives people a choice of a fast web browser and…
* It shames all the other slow web browsers into improving, or being so bad that they get left behind. 

__''…and the evolution of Blockchain''__
[>img(150px,auto)[iCSA/J7OBU.jpg]]I can't help but feel that Blockchain is sort of having the same effect. For example backups. A critical component of information security is having backups. Without backups you can't recover from an attack to a known good state very easily (even if the attacker didn't delete records did he modify any? Do you have anything to compare to?). Blockchain solves the backup problem in two simple ways: everyone has a full copy of the data if they want, and the data itself has protections that will show if it was tampered or modified. Even better I can be reasonably certain I have ALL the data and that it is up to date (it's 3am, do you know if your backups are up to date?).
When it comes to ransomware the biggest problem we see again and again is that the data that got encrypted is now effectively gone because nobody has a proper backup of it that can be recovered easily, if at all. Now to be clear I don't think we should switch every data storage medium over to some Blockchain based version (I also don't think Bitcoin is going to suddenly replace the world's banking system), but I do think we should maybe ask "why can't we have some of the benefits of Blockchain in our other data storage and processing systems?"
You can read more about Blockchain uses cases in CSA's latest research report [[here|2019.07.31 - Publication : 'Documentation of Relevant Distributed Ledger Technology and Blockchain Use Cases v2']]//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/j9rb/]] sur le blog de la CSA.
!1 - Les nouveautés CSA de la semaine du 16 au 22 septembre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Actu : Demande de validation la traduction en français de 3 documents CSA+++*[»]> <<tiddler [[2019.09.19 - Actu : Demande de validation la traduction en français de 3 documents CSA]]>>=== 
* Blog : ''CAIQ V3 Updates''+++*[»]> <<tiddler [[2019.09.17 - Blog : 'CAIQ V3 Updates']]>>=== 
* Publ : ''Consensus Assessment Initiative Questionnaire (CAIQ) v3.1''+++*[»]> <<tiddler [[2019.09.17 - Publication : 'Consensus Assessment Initiative Questionnaire (CAIQ) v3.1']]>>=== 
* Actu : Appel à commentaires sur le document ''Best Practices in Implementing a Secure Microservices Architecture''+++*[»]> <<tiddler [[2019.09.16 - Actu : Appel à commentaires, document 'Best Practices in Implementing a Secure Microservices Architecture']]>>=== 
* Blog : ''Sidechains, beacon chains and why we shouldn't give up on Blockchain performance quite yet''+++*[»]> <<tiddler [[2019.09.18 - Blog : Sidechains, beacon chains and why we shouldn't give up on Blockchain performance quite yet]]>>=== 
!2 - Veille Web
La [[Veille Web|2019.09.22 - Veille Hebdomadaire]] avec plus de 70 liens :
* __''À lire'' :__ Bilan sur la ''panne Amazon S3 du 28 février 2017''+++*[»]> 
|2019.09.16|Gremlin|![[The 2017 Amazon S3 Outage|https://www.gremlin.com/blog/the-2017-amazon-s-3-outage/]]|AWS Outage Lessons_Learnt|
=== 
* __''À lire'' :__ ''évaluer la sécurité de ses containers et de Kubernetes''+++*[»]> 
|2019.09.18|Container Journal|![[10 Questions To Assess Your Container and Kubernetes Security|https://containerjournal.com/topics/container-security/10-questions-to-assess-your-container-and-kubernetes-security/]]|Containers Kubernetes|
=== 
* ''Alertes'' : ''goHarbor.io''+++*[»]> <<tiddler [[2019.09.30 - Alertes]]>>=== 
* Rapports et sondages : ''Virtustream''+++*[»]> 
|2019.09.19|//Virtustream//|[[Services Experts to Accelerate Cloud Migrations and Drive Productivity Gains|https://www.businesswire.com/news/home/20190919005138/en/New-Research-Finds-70-Enterprises-Cloud-Managed]]|Report MSP|
|2019.09.20|//Virtustream//[>img[iCSF/flag_fr.png]]| → [[70% des entreprises font appel à des experts en service cloud managés pour accélérer les migrations|http://www.globalsecuritymag.fr/70-des-entreprises-font-appel-a,20190920,90905.html]]|Report MSP|
=== 
* Piratages et fuites de données : Erreurs de ''configurations''+++*[»]> 
|2019.09.20|//PaloAlto Networks//|![[Top 3 AWS Critical Cloud Misconfigurations and How to Remediate|https://blog.paloaltonetworks.com/2019/09/cloud-aws-critical-cloud-misconfigurations/]]|AWS Misconfigurations|
|2019.09.17|Cyber Security Hub|[[Behind The Data Breach: Understanding Cloud Security And Misconfigurations|https://www.cshub.com/cloud/articles/behind-the-data-breach-understanding-cloud-security-and-misconfigurations]]|Misconfigurations|
|2019.09.16|//PaloAlto Networks//|[[Top 10 Configuration Risks or Mistakes in Amazon Web Services (AWS) Deployment|https://pupuweb.com/configuration-risks-mistakes-aws/]]|AWS Risks Misconfigurations|
=== avec l'exemple de Malindo/Lion Air (S3)+++*[»]> 
|2019.09.17|Bleeping Computer|[[Millions of Lion Air Passenger Records Exposed and Exchanged on Forums|https://www.bleepingcomputer.com/news/security/millions-of-lion-air-passenger-records-exposed-and-exchanged-on-forums/]]|Data_Leak AWS_S3 Malindo|
|2019.09.18|South China Morning Post| → [[Malindo Air confirms data breach, exposing millions of passengers' personal data|https://www.scmp.com/news/asia/southeast-asia/article/3027780/malindo-air-confirms-data-breach-exposing-millions]]|Data_Leak AWS_S3 Malindo|
|2019.09.18|Malindo| → [[Press Statement on Data Breach|https://www.malindoair.com/news-events/2019/09/18/Press-Statement-on-Data-Breach]]|Data_Leak AWS_S3 Malindo|
|2019.09.19|Malindo| → [[Data breach investigation details|https://www.malindoair.com/news-events/2019/09/19/Data-breach-investigation-details]]|Data_Leak AWS_S3 Malindo|
|2019.09.19|Dark reading| → [[Lion Air the Latest to Get Tripped Up by Misconfigured AWS S3|https://www.darkreading.com/attacks-breaches/lion-air-the-latest-to-get-tripped-up-by-misconfigured-aws-s3-/d/d-id/1335864]]|Data_Leak AWS_S3 Malindo|
|2019.09.19|InfoSecurity Mag| → [[Lion Air Breach Hits Millions of Passengers|https://www.infosecurity-magazine.com/news/lion-air-breach-hits-millions-of/]]|Data_Leak AWS_S3 Malindo|
|2019.09.20|Information Security Newspaper| → [[Lion Air Group data breach: 35 million passenger data is leaked from AWS servers|https://www.securitynewspaper.com/2019/09/20/lion-air-group-data-breach-35-million-passenger-data-is-leaked-from-aws-servers/]]|Data_Leak AWS_S3 Malindo|
|2019.09.20|ZDnet| → [[AWS says servers secure following Malindo Air data breach|https://www.zdnet.com/article/aws-says-servers-secure-following-malindo-air-data-breach/]]|Data_Leak AWS_S3 Malindo|
=== et de la fuite de données en Equateur
* Divers : Cloud et posture sécurité, annonces Oracle et Google (Anthos), conteneurs et bonnes pratiques, ..
!3 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
<<tiddler .ReplaceTiddlerTitle with: [[2019.09.22 - Newsletter Hebdomadaire]]>>
|>|>|>|!Alerte|
|2019.09.08|MITRE|[[CVE-2019-16097|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16097]]: ^^core/api/user.go [...] allows non-admin users to create admin accounts via the POST /api/users API^^|Harbor CVE-2019-16097|
|2019.09.18|//PaloAlto Networks//|[[Critical Vulnerability in Harbor Enables Privilege Escalation from Zero to Admin (CVE-2019-16097)|https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/]]|Harbor CVE-2019-16097|
|2019.09.19|Bleeping Computer| → [[Critical Bug In Harbor Container Registry Gives Admin Access|https://www.bleepingcomputer.com/news/security/critical-bug-in-harbor-container-registry-gives-admin-access/]]|Harbor CVE-2019-16097|
|2019.09.20|GBHackers on Security| → [[Critical Vulnerability in Harbor let Hackers to Escalate Privilege by Sending Malicious Request|https://gbhackers.com/critical-vulnerability-harbor/]]|Harbor CVE-2019-16097|
|2019.09.02|Harbor|[[Disallow creating an admin user when registration #8917|https://github.com/goharbor/harbor/pull/8917]]|CVE-2019-16097 Patch|
|>|>|>|!|
|>|>|>||
|!Septembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.09.22|
|2019.09.22|nixCraft|[[Amazon Linux AMI update installed packages for security|https://www.cyberciti.biz/faq/amazon-linux-ami-update-installed-packages-for-security/]]|AWS AMI|
|2019.09.22|Kitploit|[[ArmourBird CSF - Container Security Framework|https://www.kitploit.com/2019/09/armourbird-csf-container-security.html]]|[[Tools|Outils-GitHub]] ArmourBird_CSF|
|2019.09.22|//Tripwire//|[[Building a Foundation for "Smart" Steel Factories with Fog Computing, the Cloud and Cybersecurity|https://www.tripwire.com/state-of-security/ics-security/foundation-smart-steel-factories-fog-cloud-cybersecurity/]]|Smart_Factory|
|>|>|>|!2019.09.20|
|2019.09.20|GBHackers on Security|[[How Does World's Highly Secured Google Network Works? Google's Effort & Dedication|https://gbhackers.com/google-dedicate-cyber-security/]]|Google|
|2019.09.20|Security Boulevard|[[Debunking the 5 Biggest Cloud Security Myths|https://securityboulevard.com/2019/09/debunking-the-5-biggest-cloud-security-myths/]]|Risks|
|2019.09.20|Solutions Review|[[How Do You Adapt Security When You Move to the Cloud?|https://solutionsreview.com/cloud-platforms/how-do-you-adapt-security-when-you-move-to-the-cloud/]]|Recommendations|
|2019.09.20|Redmond Channel Partner|[[Microsoft Readies Raft of Updates to Office 365 and Azure Tools|https://rcpmag.com/articles/2019/09/20/office-365-azure-tools-updates.aspx]]|O365 Azure|
|2019.09.20|IT Pro[>img[iCSF/flag_fr.png]]|[[L'adoption du Cloud va plus vite que l'évolution de la sécurité|https://www.itpro.fr/ladoption-du-cloud-va-bien-plus-vite-que-levolution-de-la-securite/]]|Report Symantec|
|2019.09.20|//Sekurigi//[>img[iCSF/flag_fr.png]]|[[Plan de Reprise d'Activites : Le Cloud à la Rescousse ?|https://www.sekurigi.com/2019/09/plan-de-reprise-dactivites-le-cloud-a-la-rescousse/]]|BCP DRP|
|2019.09.20|//PaloAlto Networks//|![[Top 3 AWS Critical Cloud Misconfigurations and How to Remediate|https://blog.paloaltonetworks.com/2019/09/cloud-aws-critical-cloud-misconfigurations/]]|AWS Misconfigurations|
|2019.09.20|//Google//|[[How to deploy a Windows container on Google Compute Engine|https://cloud.google.com/blog/products/containers-kubernetes/how-to-deploy-a-windows-container-on-google-compute-engine]]|Containers Windows|
|2019.09.20|//Gartner//|[[The Future of Network Security Is in the Cloud|https://www.zscaler.com/gartner-secure-access-service-edge-sase]]|Gartner Network|
|2019.09.20|//Zscaler//| → [[New Report from Gartner Research: The Future of Network Security Is in the Cloud|https://www.zscaler.com/blogs/corporate/new-report-gartner-research-future-network-security-cloud]]|Gartner Network|
|2019.09.20|//Zscaler//[>img[iCSF/flag_fr.png]]| → [[L'avenir de la prévention contre la perte de données est dans le cloud|https://www.informatiquenews.fr/lavenir-de-la-prevention-contre-la-perte-de-donnees-est-dans-le-cloud-didier-guyomarch-zscaler-63501]]|DLP|
|2019.09.20|//Iland//|[[Use Office 365 Backup to Protect Data from Ransomware, Insider Threats and Accidents|https://pupuweb.com/office-365-backup-protect-data-ransomware-insider-threats-accidents/]]|O365|
|2019.09.20|//JumpCloud//|[[Cloud LDAP Solution|https://jumpcloud.com/blog/cloud-ldap-solution/]]|LDAP|
|2019.09.20|//CyberArk//|[[Eight Ways to Create a Pod|https://www.cyberark.com/threat-research-blog/eight-ways-to-create-a-pod/]]|Kubernetes|
|2019.09.20|//NuData//|[[Q&A: How cloud computing protects Canadians against hackers|http://www.digitaljournal.com/tech-and-science/technology/q-a-how-cloud-computing-protects-canadians-against-hackers/article/558298]]|Threats|
|>|>|>|!2019.09.19|
|2019.09.19|Compare The Cloud|[[Top five considerations to consider when migrating security to the cloud|https://www.comparethecloud.net/articles/top-five-considerations-to-consider-when-migrating-security-to-the-cloud/]]|Migration|
|2019.09.19|Security Boulevard|[[CLOUD Act, GDPR Changing Data Protection Game|https://securityboulevard.com/2019/09/cloud-act-gdpr-changing-data-protection-game/]]|CLOUD_Act GDPR|
|2019.09.19|The Register| → [[German Government Report Digital Sovereignty|https://www.theregister.co.uk/2019/09/19/german_government_report_digital_sovereignty/]]|Sovereignty Germany|
|2019.09.20|CBR Online|[[Is the German Government Set to Kiss Goodbye to Microsoft, Amid "Digital Sovereignty" Fears?|https://www.cbronline.com/news/germany-digital-sovereignty-bmi]]|Sovereignty Germany|
|2019.09.19|//F5 Networks//[>img[iCSF/flag_fr.png]]|[[Bonnes pratiques de sécurité pour les conteneurs logiciels|http://www.globalsecuritymag.fr/Bonnes-pratiques-de-securite-pour,20190919,90894.html]]|Containers|
|2019.09.19|//Alliancy//[>img[iCSF/flag_fr.png]]|[[Cloud et cybersécurité : deux systèmes antagoniques ?|https://www.alliancy.fr/expertise/cloud/2019/09/19/cloud-et-cybersecurite-2-systemes-antagoniques]]|Misc|
|2019.09.19|//Google//|[[3 steps to detect and remediate security anomalies with Cloud Anomaly Detection|https://cloud.google.com/blog/products/identity-security/3-steps-to-detect-and-remediate-security-anomalies-with-cloud-anomaly-detection]] (3/6)|Detection|
|2019.09.19|//Trendmicro//|[[Beyond The Standard CISO Cloud Security Guide|https://blog.trendmicro.com/beyond-the-standard-ciso-cloud-security-guide/]]|Strategy|
|2019.09.19|//Managed Methods//|[[CASB 2.0: Cloud Security, Visibility and Control|https://managedmethods.com/blog/casb-2-0-cloud-security-visibility-and-control/]]|CASB|
|2019.09.19|//Trustwave//|[[Overcoming Security Policy Management Hurdles in the Cloud|https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/overcoming-security-policy-management-hurdles-in-the-cloud/]]|Policy|
|2019.09.19|//Bitglass//|[[How to tackle security in the cloud era|https://www.teiss.co.uk/cyber-security-cloud/]]|Best_Practices|
|2019.09.19|//Nucleaus Cyber//|[[Sharing Data Inside and Outside of the (Drop)Box|https://vmblog.com/archive/2019/09/19/sharing-data-inside-and-outside-of-the-drop-box.aspx]]|Dropbox|
|2019.09.19|//ThreatStack//|[[10 Automated Testing Tools That Threat Stack Uses - and Why|https://www.threatstack.com/blog/10-automated-testing-tools-that-threat-stack-uses-and-why]]|Tools|
|2019.09.19|//McAfee//|[[Detecting and Preventing Insider Threats in the Cloud|https://www.skyhighnetworks.com/cloud-security-blog/detecting-and-preventing-insider-threats-in-the-cloud/]]|Insider_Threats|
|2019.09.19|//Fugue//|[[Cloud Network Security 101: AWS Security Groups vs NACLs|https://www.fugue.co/blog/cloud-network-security-101-aws-security-groups-vs-nacls]]|AWS Access_Controls|
|2019.09.19|//Caylent//|[[AWS CloudWatch Container Insights|https://caylent.com/aws-cloudwatch-container-insights]]|AWS Containers|
|2019.09.19|//Virtustream//|[[Services Experts to Accelerate Cloud Migrations and Drive Productivity Gains|https://www.businesswire.com/news/home/20190919005138/en/New-Research-Finds-70-Enterprises-Cloud-Managed]]|Report MSP|
|2019.09.20|//Virtustream//[>img[iCSF/flag_fr.png]]| → [[70% des entreprises font appel à des experts en service cloud managés pour accélérer les migrations|http://www.globalsecuritymag.fr/70-des-entreprises-font-appel-a,20190920,90905.html]]|Report MSP|
|2019.09.19|//Outpost24//|![[Top 10 Cloud security myths infographic|https://outpost24.com/blog/Top-10-Cloud-security-myths-infographic]]|Myths|
|>|>|>|!2019.09.18|
|2019.09.18|Container Journal|![[10 Questions To Assess Your Container and Kubernetes Security|https://containerjournal.com/topics/container-security/10-questions-to-assess-your-container-and-kubernetes-security/]]|Containers Kubernetes|
|2019.09.18|Container Journal|[[Kubernetes 1.16 Update Tackles Stability and Scale|https://containerjournal.com/topics/container-ecosystems/kubernetes-1-16-update-tackles-stability-and-scale/]]|Kubernetes|
|2019.09.18|//Rapid7//|[[Cloud Security Fundamentals: Strategies to Secure Cloud Environments|https://blog.rapid7.com/2019/09/18/cloud-security-fundamentals-strategies-to-secure-cloud-environments/]]|Strategy Best_Practices|
|2019.09.18|Silicon.fr[>img[iCSF/flag_fr.png]]|[[CLOUD Act : pour AWS, la parade est dans le chiffrement des données|https://www.silicon.fr/cloud-act-aws-chiffrement-des-donnees-260865.html]]|CLOUD_Act AWS Encryption|
|2019.09.18|Fortinet[>img[iCSF/flag_fr.png]]|[[Quatre concepts essentiels pour la sécurité du cloud|https://cyberexperts.tech/quatre-concepts-essentiels-pour-la-securite-du-cloud/]]|Misc|
|2019.09.18|//Cameyo//|[[Removing Yet Another Barrier to Cloud Migration: RDP Security|https://cameyo.com/removing-yet-another-barrier-to-cloud-migration-rdp-security/]]|RDP|
|>|>|>|!2019.09.17|
|2019.09.17|Dark Reading|![[Five Common Cloud Configuration Mistakes|https://www.darkreading.com/cloud/five-common-cloud-configuration-mistakes/a/d-id/1335768]]|Miconfigurations|
|2019.09.17|HelpNet Security|[[Five ways to manage authorization in the cloud|https://www.helpnetsecurity.com/2019/09/17/manage-authorization-in-the-cloud/]]|Authorization|
|2019.09.17|Security Boulevard|[[Who's Financially Responsible for Cybersecurity Breaches?|https://securityboulevard.com/2019/09/whos-financially-responsible-for-cybersecurity-breaches/]]|
|2019.09.17|Cyber Security Hub|[[Behind The Data Breach: Understanding Cloud Security And Misconfigurations|https://www.cshub.com/cloud/articles/behind-the-data-breach-understanding-cloud-security-and-misconfigurations]]|Misconfigurations|
|2019.09.17|CIO Dive|[[Skepticism slows cloud and SaaS adoption|https://www.ciodive.com/news/skepticism-slows-cloud-and-saas-adoption/563017/]]|SaaS|
|2019.09.17|ComputerWeekly|[[Top five cloud storage pitfalls|https://www.computerweekly.com/feature/Top-five-cloud-storage-pitfalls]]|Storage|
|2019.09.17|Compare The Cloud|[[A guide to cloud-based Digital Asset Management|https://www.comparethecloud.net/articles/a-guide-to-cloud-based-digital-asset-management/]]|Asset_Management|
|2019.09.17|Infosec Institute|[[SSCP versus CCSP: Cloud security or systems security?|https://resources.infosecinstitute.com/sscp-versus-ccsp-cloud-security-or-systems-security/]]|Training|
|2019.09.17|The Register|[[VMware on AWS: Low-risk option or security blanket for those who don't like change?|https://www.theregister.co.uk/2019/09/17/vmware_on_aws_why_and_why_not/]]|AWS VMware|
|2019.09.17|Bleeping Computer|[[Millions of Lion Air Passenger Records Exposed and Exchanged on Forums|https://www.bleepingcomputer.com/news/security/millions-of-lion-air-passenger-records-exposed-and-exchanged-on-forums/]]|Data_Leak AWS_S3 Malindo|
|2019.09.18|South China Morning Post| → [[Malindo Air confirms data breach, exposing millions of passengers' personal data|https://www.scmp.com/news/asia/southeast-asia/article/3027780/malindo-air-confirms-data-breach-exposing-millions]]|Data_Leak AWS_S3 Malindo|
|2019.09.18|Malindo| → [[Press Statement on Data Breach|https://www.malindoair.com/news-events/2019/09/18/Press-Statement-on-Data-Breach]]|Data_Leak AWS_S3 Malindo|
|2019.09.19|Malindo| → [[Data breach investigation details|https://www.malindoair.com/news-events/2019/09/19/Data-breach-investigation-details]]|Data_Leak AWS_S3 Malindo|
|2019.09.19|Dark reading| → [[Lion Air the Latest to Get Tripped Up by Misconfigured AWS S3|https://www.darkreading.com/attacks-breaches/lion-air-the-latest-to-get-tripped-up-by-misconfigured-aws-s3-/d/d-id/1335864]]|Data_Leak AWS_S3 Malindo|
|2019.09.19|InfoSecurity Mag| → [[Lion Air Breach Hits Millions of Passengers|https://www.infosecurity-magazine.com/news/lion-air-breach-hits-millions-of/]]|Data_Leak AWS_S3 Malindo|
|2019.09.20|Information Security Newspaper| → [[Lion Air Group data breach: 35 million passenger data is leaked from AWS servers|https://www.securitynewspaper.com/2019/09/20/lion-air-group-data-breach-35-million-passenger-data-is-leaked-from-aws-servers/]]|Data_Leak AWS_S3 Malindo|
|2019.09.20|ZDnet| → [[AWS says servers secure following Malindo Air data breach|https://www.zdnet.com/article/aws-says-servers-secure-following-malindo-air-data-breach/]]|Data_Leak AWS_S3 Malindo|
|2019.09.17|//Tripwire//|![[Concerns and Challenges Towards an Effective Cloud Security|https://www.tripwire.com/state-of-security/security-data-protection/cloud/concerns-challenges-towards-effective-cloud-security/]]|Security_Posture|
|2019.09.17|//StackRox//|[[Why securing Kubernetes and containers can't come 'after the app'|https://siliconangle.com/2019/09/17/why-securing-kubernetes-and-containers-cant-come-after-the-app-sumoilluminate-startupoftheweek/]]|Kubernetes|
|2019.09.17|//Alston & Bird//|[[Proposed Regulations Classifying Cloud Transactions and Digital Content Released|https://www.alston.com/en/insights/publications/2019/09/proposed-regulations-classifying-cloud]]|Regulations|
|2019.09.17|//CloudRanger//|[[Self-service Disaster Recovery for AWS environments|https://cloudranger.com/self-service-disaster-recovery-for-aws-environments/]]|AWS DRaaS|
|2019.09.17|//Rhino Security Labs//|[[Abusing VPC Traffic Mirroring in AWS|https://rhinosecuritylabs.com/aws/abusing-vpc-traffic-mirroring-in-aws/]]|AWS|
|2019.09.17|//Microsoft Azure//|[[SAP on Azure Architecture - Designing for security|https://azure.microsoft.com/en-us/blog/sap-on-azure-architecture-designing-for-security/]]|Azure SAP|
|2019.09.17|//Microsoft Azure//|[[Announcing Azure Private Link|https://azure.microsoft.com/en-us/blog/announcing-azure-private-link/]]|Azure|
|2019.09.17|//NetSparker//|[[7 Crucial Components of Cyber Incident Recovery|https://www.netsparker.com/blog/web-security/incident-recovery/]]|Recovery|
|2019.09.17|//Caylent//|[[50+ Useful Kubernetes Tools|https://caylent.com/50-useful-kubernetes-tools]]|Kubernetes Tools|
|2019.09.17|//Google//|[[How Google adopted BeyondCorp: Part 3 (tiered access)|https://security.googleblog.com/2019/09/how-google-adopted-beyondcorp-part-3.html]] (3/4)|Tiered_Access|
|2019.08.|//Google//|[[How Google adopted BeyondCorp: Part 2|https://security.googleblog.com/2019/08/how-google-adopted-beyondcorp-part-2.html]] (2/4)|Misc|
|2019.06.|//Google//|[[How Google adopted BeyondCorp: Part 1|https://security.googleblog.com/2019/06/how-google-adopted-beyondcorp.html]] (1/4)|Misc|
|>|>|>|!2019.09.16|
|2019.09.16|IT Expresso[>img[iCSF/flag_fr.png]]|[[!CLOUD Act : pourquoi ça vous concerne|https://www.itespresso.fr/cloud-act-pourquoi-ca-vous-concerne-210997.html]]|CLOUD_Act|
|2019.09.16|ZDNet[>img[iCSF/flag_fr.png]]|[[Le cloud hybride, une approche intéressante pour la sécurité des données et de la continuité d'activité|https://www.zdnet.fr/actualites/le-cloud-hybride-une-approche-interessante-pour-la-securite-des-donnees-et-de-la-continuite-d-activite-39890677.htm]]|Hybrid_Cloud|
|2019.09.16|Gremlin|![[The 2017 Amazon S3 Outage|https://www.gremlin.com/blog/the-2017-amazon-s-3-outage/]]|AWS Outage Lessons_Learnt|
|2019.09.16|DZone|[[Getting Started With AWS Networking Services - Part 2|https://dzone.com/articles/getting-started-with-aws-networking-services-part]] (2/2)|AWS|
|2019.09.16|The Hacker News|[[How Cloud-Based Automation Can Keep Business Operations Secure|https://thehackernews.com/2019/09/how-cloud-based-automation-can-keep.html]]|M%isc|
|2019.09.16|NextGov|[[Agencies to Security Industry: Automate Cloud Compliance Faster|https://www.nextgov.com/ideas/2019/09/agencies-security-industry-automate-cloud-compliance-faster/159895/]]|Compliance|
|2019.09.16|VPNmentor|[[Report: Ecuadorian Breach Reveals Sensitive Personal Data|https://www.vpnmentor.com/blog/report-ecuador-leak/]]|DataLeak ElasticSearch Ecuador|
|2019.09.16|ZDNet| → [[Database leaks data on most of Ecuador's citizens, including 6.7 million children|https://www.zdnet.com/article/database-leaks-data-on-most-of-ecuadors-citizens-including-6-7-million-children/]]|DataLeak ElasticSearch Ecuador|
|2019.09.20|CyberSecurity Hub| → [[Incident Of The Week: Cloud Misconfiguration Exposes 20 Million Ecuador Citizen Records|https://www.cshub.com/data/articles/incident-of-the-week-cloud-misconfiguration-exposes-20-million-ecuador-citizen-records]]|DataLeak ElasticSearch Ecuador|
|2019.09.16|//PaloAlto Networks//|[[Top 10 Configuration Risks or Mistakes in Amazon Web Services (AWS) Deployment|https://pupuweb.com/configuration-risks-mistakes-aws/]]|AWS Risks Misconfigurations|
|2019.09.16|//AWS//|[[You all know why you should encrypt your cloud data – now learn where and how…|https://www.theregister.co.uk/2019/09/16/aws_encryption_webinar/]]|AWS Encryption|
|2019.09.16|//Google//|[[Anthos simplifies application modernization with managed service mesh and serverless for your hybrid cloud|https://cloud.google.com/blog/topics/hybrid-cloud/anthos-simplifies-application-modernization-with-managed-service-mesh-and-serverless-for-your-hybrid-cloud]]|GCP Anthos|
|2019.09.17|Container Journal| → [[Google Extends Scope of Anthos Cloud Platform|https://containerjournal.com/topics/container-management/google-extends-scope-of-anthos-cloud-platform/]]|GCP Anthos|
|2019.09.16|//Avanan//|[[5 Reasons Microsoft Safe Links Make Office 365 Less Safe|https://www.avanan.com/resources/microsoft-atp-safe-links]]|O365|
|2019.09.16|//Oracle//|[[Oracle Cloud Automates Security for Critical Workloads|https://www.prnewswire.com/news-releases/oracle-cloud-automates-security-for-critical-workloads-300918989.html]]|Oracle|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Septembre 2019]]>>
[>img[iCSF/cloud-security-alliance-fr.png]]La [[Cloud Security Alliance]] a lancé la traduction de 3 outils majeurs dans 10 langues : allemand, danois, espagnol, italien, japonais, néerlandais, portugais, roumain, suédois, et ... français.
Il s'agit de feuilles Excel dans lesquelles il vous est demandé d'adapter les traductions ou de les commenter.
Pour chaque document, les 10 traductions sont dans un répertoire //Google Drive// dédié, et pour travailler sur la version française, il faut sélectionner le document commençant par "''FR-''"

Les 3 documents sont les suivants :
* "''Cloud Controls Matrix''" (CCM) : document "FR-CSA_CCM_v.3.0.1-09-01-2017_FINAL.xlsx"
:→ ''[[CloudSecurityAlliance.fr/go/j99c/|https://cloudsecurityalliance.fr/go/j99c/]]''
* "''Consensus Assessments Initiative Questionnaire''" (CAIQ) : document "FR-CAIQ_v3.0.1-09-01-2017_FINAL.xlsx"
:→ ''[[CloudSecurityAlliance.fr/go/j99q/|https://cloudsecurityalliance.fr/go/j99q/]]''
* "''Code of Conduct''" du "''Privacy Level Agreement''" (PLA CoC) : document "FR-CoC_GDPR_Annex_1_Compliance_Assessment_Template.xlsx"
:→ ''[[CloudSecurityAlliance.fr/go/j99p/|https://cloudsecurityalliance.fr/go/j99p/]]''

La date limite initialement fixée au 2 octobre 2019 a été repoussée au ''25 octobre 2019''.
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Sidechains, beacon chains and why we shouldn't give up on Blockchain performance quite yet//"
[>img(150px,auto)[iCSA/J8QBO.png]]Article de blog publié le 18 septembre 2019 — Rédigé par Kurt Seifried, Chief Blockchain Officer, CSA
<<<
//If you've been in IT you've probably learned one of the simple lessons:
* Scaling out is hard and can be expensive, but scaling up is easy and even more expensive. In simple terms if you can scale out you can keep costs down, ideally at a linear growth rate (e.g. handling twice as much web traffic by simply buying a second server).
* Scaling up is often easier, you want code to run twice as fast, simply get a computer that has a much faster CPU (both capability and clock rate wise), but scaling up quickly hits boundaries (like what's the fastest single system you can buy).
* What usually ends up happening is you try to identify as many spots as possible where you can turn serial operations into parallel operations, and do them not only on multiple systems, but at the same time. 

__''Scaling for Blockchain''__
Blockchains are no different. The majority of current Blockchain technologies are sold as decentralized and massively parallel, and they are. But while most current Blockchain technologies create multiple blocks at the same time, only one block is picked or "wins consensus" at which point all the other work is thrown out, and a new block is started on (so not very efficient). Bitcoin is an extreme example with each block taking about 10 minutes to create. So despite having millions of systems mining for a valid Bitcoin it can only do a total of 1 block every 10 minutes (worse, this is a chosen value for a variety of economic reasons, in other words an arbitrary limitation that probably won't change much in the future). Even if you are mining large blocks to improve throughput this 10 minute creation time introduces a major amount of latency; payments that are processed on the main Bitcoin Blockchain take at least 10 minutes to clear and sometimes longer. Imagine trying to use a Bitcoin payment system at the supermarket and having to wait 10 or more minutes for the payment system to tell you if the payment went through or not before you can leave with your groceries. The technology and choices used by the Ethereum Blockchain are better, with blocks taking 10 to 19 seconds to create, but this is still a lot longer than most electronic payment systems take to process and approve a payment. 

__''Using Side Chains (or shared chains)''__
[>img(50%,auto)[Ethereum 2.0 overall architecture. Original diagram by Hsiao-Wei Wang|iCSA/J9IBS.png]]The obvious solution is to not only allow for more parallel block creation but to pick more than one winner. There are a number of names for the various strategies here but they are often referred to as side chains or shard chains, or more technology specific names like Ethereum's "beacon chain" proposal. As you can see from the diagram below the beacon chain is a non trivial matter, if you want to understand it there are a number of good write ups on it.

So yet again we have a classic bad news/good news situation. The bad news is that the current Blockchain technology doesn't scale very well, typically has high latencies, and low throughput. The good news is that the fundamental concept of Blockchain (an immutable distributed ledger technology with distributed consensus mechanisms) is good, and people are working on the scaling, latency and throughput, and more.//
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/j9ib/]] sur le blog de la CSA


!Mise à jour de CAIQ en version 3.1
<<<
[>img(200px,auto)[iCSA/J9HBC.png]]//Cloud Security Alliance (CSA) would like to present the next version of the [[Consensus Assessments Initiative Questionnaire (CAIQ)]] v3.1.

The CAIQ offers an industry-accepted way to document what security controls exist in IaaS, PaaS, and SaaS services, providing security control transparency. It provides a set of Yes/No questions a cloud consumer and cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the Cloud Controls Matrix (CCM). Therefore, it helps cloud customers to gauge the security posture of prospective cloud service providers and determine if their cloud services are suitably secure.

CAIQ v3.1 represents a minor update to the previous CAIQ v3.0.1. In addition to improving the clarity and accuracy, it also supports better auditability of the CCM controls. The new updated version aims to not only correct errors but also appropriately align and improve the semantics of unclear questions for corresponding CCM v3.0.1 controls. In total, 49 new questions were added, and 25 existing ones were revised.

For this new CAIQ version, CSA took into account the combined comprehensive feedback that was collected over the years from its partners, the industry and the [[CCM working group|https://cloudsecurityalliance.org/research/working-groups/cloud-controls-matrix/]].//
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/j9hc/]] sur le blog de la CSA.
&rArr; [[Consensus Assessments Initiative Questionnaire (CAIQ) v3.1|https://CloudSecurityAlliance.fr/go/j9hq/]]
!"//Consensus Assessment Initiative Questionnaire (CAIQ) v3.1'//"
<<<
[>img(200px,auto)[iCSA/J9HBC.png]]//The Consensus Assessment Initiative Questionnaire (CAIQ) provides industry-accepted way to document what security controls exist in IaaS, PaaS, and SaaS offerings, providing security control transparency. It helps cloud customers gauge the security posture of prospective cloud service providers to determine if their cloud services are suitably secure.
The CAIQ v3.1 is an update to the existing CAIQ that fixes errors, non-alignment or unclear questions. To participate in this review, please review ONLY questions in Column E. Let us know if they continue to be unclear, incorrect or align poorly with the corresponding CCM control.
We are not accepting suggestions for completely new questions.//
<<<
&rArr; ''[[CloudSecurityAlliance.fr/go/j9hq/|https://CloudSecurityAlliance.fr/go/j9hq/]]
!//Best Practices in Implementing a Secure Microservices Architecture//[>img(100px,auto)[iCSA/CSAdoc.png]]
Un appel à commentaires dont la date de clôture est le ''16 octobre 2019'' : "''Best Practices in Implementing a Secure Microservices Architecture''".
<<<
//Application containers and a microservices architecture are being used to design, develop, and deploy applications leveraging agile software development approaches such as Development Operations. Security needs to be embedded into these software development approaches. This document serves to identify best practices in securing microservices in the engineering of trustworthy secure systems through the lens of the Developer, Operator, and Architect.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j9gb/|https://cloudsecurityalliance.fr/go/j9gb/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!1 - Les nouveautés CSA de la semaine du 9 au 15 septembre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Actu : Demande de ''validation de la traduction en français'' de 3 documents documents CSA : ''Cloud Controls Matrix'' (''CCM'')+++*[»]> <<tiddler [[2019.09.09 - Actu : Traduction de la 'Cloud Controls Matrix' (CCM)]]>>===, ''Consensus Assessments Initiative Questionnaire'' (''CAIQ'')+++*[»]> <<tiddler [[2019.09.09 - Actu : Traduction du 'Consensus Assessments Initiative Questionnaire' (CAIQ)]]>>===, et ''Code of Conduct'' du ''Privacy Level Agreement'' (''PLA CoC'')+++*[»]> <<tiddler [[2019.09.09 - Actu : Traduction du 'Code of Conduct' du 'Privacy Level Agreement' (PLA CoC)]]>>=== 
* Blog : ''Egregious 11 Meta-Analysis Part 3: Weak Control Plane and DoS''+++*[»]> <<tiddler [[2019.09.12 - Blog : 'Egregious 11 Meta-Analysis Part 3: Weak Control Plane and DoS']]>>=== 
* Blog : article "''Open API Survey Report''"+++*[»]> <<tiddler [[2019.09.11 - Blog : 'Open API Survey Report']]>>=== 
* Publ : document "''Gap Analysis Report on Mapping CSA's Cloud Controls Matrix to 'Guideline on Effectively Managing Security Service in the Cloud'''"+++*[»]> <<tiddler [[2019.09.05 - Publication : Gap Analysis Report on Mapping CSA's Cloud Controls Matrix to 'Guideline on Effectively Managing Security Service in the Cloud']]>>=== 
* Publ : document "''Mapping of 'The Guidelines' Security Recommendations to CCM''"+++*[»]> <<tiddler [[2019.09.05 - Publication : Mapping of 'The Guidelines' Security Recommendations to CCM]]>>=== 
* Actu : Les formations lors du ''Congrès CSA EMEA'' en Novembre à Berlin+++*[»]> <<tiddler [[2019.09.12 - Actu : Les formations lors du Congrès CSA EMEA en Novembre à Berlin]]>>=== 
* Actu : Le ''CCSK'' est une certification reconnue par le Ministère des Anciens Combattants américain+++*[»]> <<tiddler [[2019.09.10 - Actu : Le CCSK est une certification reconnue par le Ministère des Anciens Combattants américain]]>>=== 
!2 - Veille Web
La [[Veille Web|2019.09.15 - Veille Hebdomadaire]] avec une quarantaine de liens :
* __''À lire'' :__ Thèse professionnelle du Mastere Spécialisé ISEP "Expert Cloud Computing"+++*[»]> <<tiddler [[Partenariats - ISEP-FC - Masteres Spécialisés]]>>=== sur la commercialisation des données dans le Cloud (//Nuageo//)+++*[»]> 
|2019.09.12|//Nuageo//|[[Vos données, leur valeur et le bon Cloud pour les vendre|https://www.nuageo.fr/2019/09/donnees-valeur-cloud-vendre/]]|Data Management|
|~|ISEP|Thèse [[Le Cloud Computing peut-il aider l'entreprise à commercialiser ses données ?|https://formation-continue.isep.fr/theses-professionnelles/]] dans le cadre du [[Mastere Spécialisé ISEP 'Expert Cloud Computing'|Partenariats - ISEP-FC - Masteres Spécialisés]]|~|
=== 
* Pannes : ''Box''
* Rapports et sondages : Publication par l'''OWASP'' du draft "''API Security Top 10''"+++*[»]> 
|2019.09.13|OWASP|[[API Security Top 10 Release Candidate is Here!|https://www.owasp.org/index.php/OWASP_API_Security_Project]] ([[document PDF|https://www.owasp.org/images/5/59/API_Security_Top_10_RC.pdf]])|APIs|
|2019.09.12|Dark Reading| → [[APIs Get Their Own Top 10 Security List|https://www.darkreading.com/application-security/apis-get-their-own-top-10-security-list/d/d-id/1335786]]|APIs|
=== 
* Divers : Brexit+++*[»]> 
|2019.09.12|The Register|![[Cloud, internet biz will take a Yellowhammer to the head in 'worst case' no-deal Brexit|https://www.theregister.co.uk/2019/09/12/cloud_providers_yellowhammer_brexit/]] (rapport [[YellowHammer|https://regmedia.co.uk/2019/09/11/latest_yellowhammer_planning.pdf]])|Brexit|
===, bonnes pratiques de sécurisation Cloud (//CyberArk//+++*[»]> 
|2019.09.12|//CyberArk//|![[Best Practices for Securing Cloud-Based Applications and Infrastructure|https://www.cyberark.com/blog/best-practices-for-securing-cloud-based-applications-and-infrastructure/]]|Best_Practices|
===), réflexions sur la sécurité d'Office 365 (//Fox-IT//+++*[»]> 
|2019.09.11|//Fox IT//|![[Office 365: prone to security breaches?|https://blog.fox-it.com/2019/09/11/office-365-prone-to-security-breaches/]]|O365 Risks Detection|
===), CCAT (outil de sécurisation de containers+++*[»]> 
|2019.09.09|The Daily Swig|[[Open source tool helps test security of cloud containers|https://portswigger.net/daily-swig/open-source-tool-helps-test-security-of-cloud-containers]]|[[Tools|Outils-GitHub]] CCAT|

|[[Cloud Container Attack Tool (CCAT)|https://github.com/RhinoSecurityLabs/ccat]]|[[RhinoSecurity|https://rhinosecuritylabs.com/]]|Tool for testing security of container environment|
===)
!3 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Septembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.09.14|
|2019.09.14|Global Security Mag[>img[iCSF/flag_fr.png]]|[[Club de la Presse Informatique B2B : Le Cloud plus sécurisé que le fait maison !|http://www.globalsecuritymag.fr/Club-de-la-Presse-Informatique-B2B,20190911,90599.html]]|Trends|
|>|>|>|!2019.09.13|
|2019.09.13|OWASP|[[API Security Top 10 Release Candidate is Here!|https://www.owasp.org/index.php/OWASP_API_Security_Project]] ([[document PDF|https://www.owasp.org/images/5/59/API_Security_Top_10_RC.pdf]])|APIs|
|2019.09.12|Dark Reading| → [[APIs Get Their Own Top 10 Security List|https://www.darkreading.com/application-security/apis-get-their-own-top-10-security-list/d/d-id/1335786]]|APIs|
|2019.09.13|HelpNet Security|[[The rise of modern applications, DevSecOps and the intelligence economy|https://www.helpnetsecurity.com/2019/09/13/multi-cloud-adoption-growth/]]|Report Sumo_Logic|
|2019.09.13|//CCSI//|[[Expert Opinion on Avoiding Common Cloud Protection Pitfalls|https://www.ccsinet.com/blog/avoiding-cloud-pitfalls/]]|Recommendations|
|2019.09.13|//MalwareBytes//|[[Hacking with AWS: incorporating leaky buckets into your OSINT workflow|https://blog.malwarebytes.com/researchers-corner/2019/09/hacking-with-aws-incorporating-leaky-buckets-osint-workflow/]]|OSINT AWS|
|2019.09.13|//VMblog//|[[Top 7 Cloud Computing Security Threats|https://vmblog.com/archive/2019/09/13/top-7-cloud-computing-security-threats.aspx]]|Threats|
|>|>|>|!2019.09.12|
|2019.09.12|The Register|![[Cloud, internet biz will take a Yellowhammer to the head in 'worst case' no-deal Brexit|https://www.theregister.co.uk/2019/09/12/cloud_providers_yellowhammer_brexit/]] (rapport [[YellowHammer|https://regmedia.co.uk/2019/09/11/latest_yellowhammer_planning.pdf]])|Brexit|
|2019.09.12|Network World|[[IBM z15 mainframe, amps-up cloud, security features|https://www.networkworld.com/article/3438542/ibm-z15-mainframe-amps-up-cloud-security-features.html]]|Mainframes|
|2019.09.12|//Nuageo//[>img[iCSF/flag_fr.png]]|[[Vos données, leur valeur et le bon Cloud pour les vendre|https://www.nuageo.fr/2019/09/donnees-valeur-cloud-vendre/]]|Data Management|
|~|ISEP|Thèse [[Le Cloud Computing peut-il aider l'entreprise à commercialiser ses données ?|https://formation-continue.isep.fr/theses-professionnelles/]] dans le cadre du [[Mastere Spécialisé ISEP 'Expert Cloud Computing'|Partenariats - ISEP-FC - Masteres Spécialisés]]|~|
|2019.09.12|//Managed Methods//|[[8 Business Challenges A CASB Solves|https://managedmethods.com/blog/casb-solves-business-challenges/]]|CASB|
|2019.09.12|//Google//|[[Catch web app vulnerabilities before they hit production with Cloud Web Security Scanner|https://cloud.google.com/blog/products/identity-security/catch-web-app-vulnerabilities-before-they-hit-production-with-cloud-web-security-scanner]] (2/6)|Tools|
|2019.09.11|//Google//| → [[How to use Cloud Security Scanner - Getting Started with Cloud Security Command Center (vidéo)|https://www.youtube.com/watch?v=goJ_G2ygdSA]]|Tools|
|2019.09.12|//Box//|[[Incident Report for Box|https://status.box.com/incidents/fhx3xs37vvgf?u=bdr8lqbn0f1q]]|Outage Box|
|2019.09.12|//CyberArk//|![[Best Practices for Securing Cloud-Based Applications and Infrastructure|https://www.cyberark.com/blog/best-practices-for-securing-cloud-based-applications-and-infrastructure/]]|Best_Practices|
|2019.09.12|//CloudCheckr//|[[Government Cloud Services vs. Agency Data Centers|https://cloudcheckr.com/uncategorized/government-cloud-services-vs-data-centers/]]|Government|
|2019.09.12|//Microsoft//|[[Cloud backup and recovery for the Microsoft Authenticator app on Android now available |https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Cloud-backup-and-recovery-for-the-Microsoft-Authenticator-app-on/ba-p/566369]]|Microsoft Authentication|
|2019.09.12|ZDnet| → [[Microsoft Authenticator on Android gets cloud backup and recovery|https://www.zdnet.com/article/microsoft-authenticator-on-android-gets-cloud-backup-and-recovery/]]|Microsoft Authentication|
|2019.09.12|//Imperva//|[[APIs Ease Customer Interaction - and External Attacks. Here's how to Protect Them|https://www.imperva.com/blog/apis-ease-customer-interaction-and-external-attacks-heres-how-to-protect-them/]]|APIs|
|2019.09.12|//AppSecCo//|[[Presenting a modern cloud based vulnerable Android app - VyAPI|https://blog.appsecco.com/vyapi-the-modern-cloud-based-vulnerable-hybrid-android-app-ee300a9d60ed]]|[[Tools|Outils-GitHub]]|
|2019.09.12|//AppSecCo//|[[The Story of how I made a vulnerable Android App VyAPI|https://blog.appsecco.com/vyapi-the-story-of-a-vulnerable-hybrid-android-app-aee44f6d1f2d]]|[[Tools|Outils-GitHub]]	|
|2019.09.12|//Rancher Labs//|[[Your Guide to Container Security|https://rancher.com/complete-guide-container-security/]]|Containers|
|>|>|>|!2019.09.11|
|2019.09.11|L'Informaticien[>img[iCSF/flag_fr.png]]|![[Le Cloud Made in France|https://www.linformaticien.com/dossiers/le-cloud-made-in-france.aspx]]|France|
|2019.09.11|Place de l'IT[>img[iCSF/flag_fr.png]]|[[Alain Bouillé, Cesin: "Le multi-cloud au cœur des préoccupations de cybersécurité"|https://placedelit.com/interview-alain-bouille-cesin-multi-cloud-cybersecurite/]]|Multi_Cloud|
|2019.09.11|VMblog|[[Benefits and Challenges of a Cloud Digital Asset Management Infrastructure|https://vmblog.com/archive/2019/09/11/benefits-and-challenges-of-a-cloud-digital-asset-management-infrastructure.aspx]]|Asset_Management|
|2019.09.09|Bleeping Computer|[[Microsoft to Improve Office 365 Phishing Email Notifications|https://www.bleepingcomputer.com/news/security/microsoft-to-improve-office-365-phishing-email-notifications/]]|O365 Phishing|
|2019.09.11|Cloud Native Computing Foundation|[[Kubernetes IoT Edge WG: Identifying Security Issues at the Edge|https://www.cncf.io/blog/2019/09/11/kubernetes-iot-edge-wg-identifying-security-issues-at-the-edge/]]|Kubernetes IoT|
|2019.09.11|CBR Online|[[Slack Rolls Out European Data Residency|https://www.cbronline.com/news/slack-european-data-residency]]|Slack GDPR|
|2019.09.11|//Fox IT//|![[Office 365: prone to security breaches?|https://blog.fox-it.com/2019/09/11/office-365-prone-to-security-breaches/]]|O365 Risks Detection|
|2019.09.11|//Park My Cloud//|[[How Much Do the Differences Between Cloud Providers Actually Matter?|https://www.parkmycloud.com/blog/cloud-providers/]]|Misc|
|2019.09.11|//Menlo Security//|[[Internet Isolation Cloud: Introducing a New Paradigm|https://www.menlosecurity.com/blog/internet-isolation-cloud-introducing-a-new-paradigm]]|Isolation|
|2019.09.11|//Tuffin//|[[Restoring the balance between agility and security in the cloud|https://www.itproportal.com/features/restoring-the-balance-between-agility-and-security-in-the-cloud/]]|Recommendations|
|2019.09.11|//Rancher Labs//|[[DevOps and Containers, On-Prem or in the Cloud|https://rancher.com/devops-containers-prem-cloud/]]|DevSecOps Containers|
|2019.09.11|//Rancher Labs//|![[Container Security Tools Breakdown|https://rancher.com/container-security-tools-breakdown/]] (mise à jour)|Containers Tools|
|2019.09.11|//Rancher Labs//|[[Introduction to Container Security|https://rancher.com/blog/2018/2018-09-12-introduction-to-container-security-1/]]|Containers|
|2019.09.11|//Rancher Labs//|[[Comparing 10 Docker Container Monitoring Solutions for Rancher|https://rancher.com/comparing-10-container-monitoring-solutions-rancher/]]|Containers Monitoring|
|2019.09.11|//Rancher Labs//|[[What is a CaaS? Containers as a Service, Defined|https://rancher.com/caas-containers-service-defined/]] (mise à jour)|Containers|
|2019.09.11|//Rancher Labs//|[[An Introduction to Containers|https://rancher.com/blog/2019/an-introduction-to-containers/]] (mise à jour)|Containers|
|2019.09.11|//Rancher Labs//|![[101 More Security Best Practices for Kubernetes|https://rancher.com/blog/2019/2019-01-17-101-more-kubernetes-security-best-practices/]]|Kubernetes Best_Practices|
|2019.09.11|//Rancher Labs//|[[Kubernetes vs Docker Swarm: Comparison of Two Container Orchestration Tools|https://rancher.com/blog/2019/kuberntes-versus-docker-swarm/]] (mise à jour)|Container Orchestration Kubernetes Docker_Swarm|
|2019.09.11|//Rancher Labs//|[[Containers vs. Serverless Computing|https://rancher.com/containers-vs-serverless-computing/]] (mise à jour)|Containers Serveless|
|2019.09.11|//Rancher Labs//|[[The Similarities and Differences Between Windows and Linux Containers|https://rancher.com/the-similarities-and-differences-between-windows-and-linux-containers/]] (mise à jour)|Containers|
|2019.09.11|//Rancher Labs//|[[Playing Catch-up with Docker and Containers|https://rancher.com/playing-catch-docker-containers/]] (mise à jour)|Docker Containers|
|>|>|>|!2019.09.10|
|2019.09.10|DZone|[[Getting Started With AWS Networking Services - Part 1|https://dzone.com/articles/understanding-aws-networking]] (1/2)|AWS|
|2019.09.10|ZDnet|[[Microsoft: Office 365 gets automated response to phishing, nasty links, malware|https://www.zdnet.com/article/microsoft-office-365-gets-automated-response-to-phishing-nasty-links-malware/]]|O365 ATP|
|2019.09.10|Security Boulevard|[[How Security Can Lead in Cloud-Dependent Business Innovation|https://securityboulevard.com/2019/09/how-security-can-lead-in-cloud-dependent-business-innovation/]]|Misc|
|2019.09.10|Container Journal|[[Kubernetes in the Enterprise: A Primer|https://containerjournal.com/topics/container-ecosystems/kubernetes-in-the-enterprise-a-primer/]]|Kubernetes|
|2019.09.10|HelpNet Security|[[Office 365 security: Automated incident response based on playbooks|https://www.helpnetsecurity.com/2019/09/10/office-365-incident-response/]]|O365 Incident_Response|
|2019.09.10|NextGov|[[DISA is Merging Its Cyber Operations Into a Single Cloud-Based Platform|https://www.nextgov.com/cybersecurity/2019/09/disa-merging-its-cyber-operations-single-cloud-based-platform/159739/]]|Government|
|2019.09.10|//Microsoft//|[[Monitoring on Azure HDInsight part 4: Workload metrics and logs|https://azure.microsoft.com/en-us/blog/monitoring-on-azure-hdinsight-part-4-workload-metrics-and-logs/]] (4/4)|Azure Monitoring|
|2019.09.10|//Thales Security//|[[What will be your decisive moment to secure your cloud applications in a Zero Trust world?|https://blog.thalesesecurity.com/2019/09/10/what-will-be-your-decisive-moment-to-secure-your-cloud-applications-in-a-zero-trust-world/]]|Zero_Trust|
|2019.09.10|//CyberSecurity Help//|[[Command injection in Docker (CVE-2019-13139)|https://www.cybersecurity-help.cz/vdb/SB2019091002]]|CVE-2019-13139|
|2019.09.10|//Netwrix//|[[70% of educational orgs don't have an appropriate cloud security budget|https://www.helpnetsecurity.com/2019/09/10/education-cloud-security-budget/]]Report Netwrix|
|2019.09.10|//ManagedMethods//|[[5 Cloud Application Security Best Practices|https://managedmethods.com/blog/cloud-application-security-best-practices/]]|Best_Practices|
|2019.09.09|//BitDefender//|[[Top Inherent Risks with Cloud Security|https://businessinsights.bitdefender.com/top-risks-inherent-with-cloud-security]]|Risks|
|2019.09.10|//DivvyCloud//|[[Remediating Misconfigurations to Keep Your Cloud Out of the News|https://divvycloud.com/blog/remediating-misconfigurations-keeping-your-cloud-out-of-news/]]|Misconfigurations|
|2019.09.10|//Outpost24//|[[Cloud security: an inconvenient truth about IT transformation|https://outpost24.com/blog/Cloud-security-an-inconvenient-truth-about-IT-transformation]]|Misc|
|2019.09.10|//Security Intelligence//|[[Podcast: Cloud Security and the Road to Transformation|https://securityintelligence.com/media/podcast-cloud-security-and-the-road-to-transformation/]] ([[audio|https://soundcloud.com/securityintelligence/cloud-security-and-the-road-to-transformation]])|Misc|
|2019.09.10|//HiveMQ//|[[Role Based Access Control to Secure an MQTT Broker|https://www.hivemq.com/blog/rbac-for-the-control-center-with-ese/]]|MQTT|
|2019.09.10|//Insight France//[>img[iCSF/flag_fr.png]]|[[Le cloud est perçu comme un atout pour la sécurité|https://www.informatiquenews.fr/le-cloud-est-percu-comme-un-atout-pour-la-securitedaniel-gonzalez-insight-france-63273]]|Misc|
|2019.09.10|//Rubrik//|[[Backup as a platform busts a move in multicloud, ransomware and GDPR|https://siliconangle.com/2019/09/10/backup-as-a-platform-busts-multicloud-ransomware-gdpr-moves-vmworld-startupoftheweek/]]|Backup GDPR|
|2019.09.10|//McAfee//|[[Modernizing FedRAMP is Essential to Enhanced Cloud Security|https://securingtomorrow.mcafee.com/other-blogs/executive-perspectives/modernizing-fedramp-is-essential-to-enhanced-cloud-security/]]|Regulations FedRAMP|
|2019.09.10|//Shared Assessments//|[[What 'Virtual' Means When Conducting Assessments|https://sharedassessments.org/what-virtual-means-when-conducting-assessments/]]|Misc|
|>|>|>|!2019.09.09|
|2019.09.09|The Daily Swig|[[Open source tool helps test security of cloud containers|https://portswigger.net/daily-swig/open-source-tool-helps-test-security-of-cloud-containers]]|[[Tools|Outils-GitHub]] CCAT|
|2019.09.09|Insider Pro|[[Cloud security: Inside the shared responsibility model|https://www.idginsiderpro.com/article/3437042/cloud-security-inside-the-shared-responsibility-model.html]]|Shared_Responsibility CapitalOne|
|2019.09.09|Silicon Angle|[[Google Cloud gets rootkit-resistant Kubernetes nodes, better SAP support|https://siliconangle.com/2019/09/09/google-cloud-gets-rootkit-resistant-kubernetes-nodes-better-sap-support/]]|GCP Kubernetes|
|2019.09.09|//Microsoft//|[[Automated incident response in Office 365 ATP now generally available|https://www.microsoft.com/security/blog/2019/09/09/automated-incident-response-office-365-atp-now-generally-available/]]|O365 Advanced_Threat_Protection|
|2019.09.09|Bleeping Computer| → [[Office 365 ATP Automated Incident Response Now Generally Available|https://www.bleepingcomputer.com/news/microsoft/office-365-atp-automated-incident-response-now-generally-available/]]|O365 Advanced_Threat_Protection|
|2019.09.09|Security Week| → [[Microsoft Makes Automated Incident Response in Office 365 ATP Generally Available|https://www.securityweek.com/microsoft-makes-automated-incident-response-office-365-atp-generally-available]]|O365 Advanced_Threat_Protection|
|2019.09.09|//Synopsys//|[[Ask the experts: What's the top security risk during cloud migration?|https://www.synopsys.com/blogs/software-security/top-cloud-security-risks/]]|Risks|
|2019.09.09|//Alibaba//|[[Kubernetes Eviction Policies for Handling Low RAM and Disk Space Situations - Part 1|https://medium.com/@Alibaba_Cloud/kubernetes-eviction-policies-for-handling-low-ram-and-disk-space-situations-part-1-1a2068d7e856]] (1/2)|Kubernetes|
|2019.09.09|//Alibaba//|[[Kubernetes Eviction Policies for Handling Low RAM and Disk Space Situations - Part 2|https://medium.com/@Alibaba_Cloud/kubernetes-eviction-policies-for-handling-low-ram-and-disk-space-situations-part-2-d63596aec9d2]] (2/2)|Kubernetes|
|2019.09.09|//Mobiquity//|[[The Call for Continuous Security|https://www.mobiquity.com/resources/the-call-for-continuous-security]]|Misc|
|2019.09.09|//D2SI//[>img[iCSF/flag_fr.png]]|[[Sécurité sur le Cloud : quelle politique de conformité et de remédiation ?|https://blog.d2si.io/2019/09/09/securite-cloud-conformite/]]|Compliance|
|2019.09.09|//Bitglass//|[[The Four Pillars of CASB: Threat Protection|https://www.bitglass.com/blog/four-pillars-casb-threat-protection]]|CASB|
|2019.09.09|//DivvyCloud//|[[Remediating Misconfigurations to Keep Your Cloud Out of the News|https://divvycloud.com/blog/remediating-misconfigurations-keeping-your-cloud-out-of-news/]]|Misconfigurations|
|2019.09.09|//Microsoft//|![[Manage emergency access accounts in Azure AD|https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-emergency-access]]|AzureAD Mitigation|
|2019.10.21|//Microsoft//|[[About Site Recovery|https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-overview]]|Azure DRP|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Septembre 2019]]>>
!"Cloud Security Alliance EMEA Congress 2019 to Host Career-Advancing Cloud Security and Privacy Training Opportunities"
<<<
[>img(auto,100px)[iCSA/J91GCLACT.png]][>img(auto,100px)[iCSA/J91GDPRTrain.png]][>img(auto,100px)[iCSA/J73CCSK.png]]//Attendees can take advantage of top-ranked courses on CCSK Foundation, GDPR Lead Auditor, and Cloud Governance and Compliance Training

Berlin, Germany – Sept. 12, 2019 – The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, is pleased to offer three exclusive training opportunities at CSA EMEA Congress (Berlin, Nov. 18-21, 2019). Attendees interested in furthering their cloud and information security careers by becoming a GDPR lead auditor, deepening their understanding of CSA's Cloud Control Matrix (CCM), or preparing to take the Certificate of Cloud Security Knowledge (CCSK) exam can take advantage of some of the industry's highest-rated training courses while attending the conference.

"It's imperative that cloud security practitioners stay current on the latest threats and accordingly, the most sophisticated ways in which to guard against them," said Daniele Catteddu, Chief Technology Officer, Cloud Security Alliance. "CSA's training courses are among the industry's best - in fact, CRN recently rated the CCSK as among the seven must-have cloud security certificates+++*[»]> https://www.crn.com/slide-shows/cloud/7-must-have-cloud-security-certifications-in-2019/3 ===. This year's CSA Congress EMEA affords those looking to advance their knowledge of cloud security with two excellent training opportunities, while those interested in qualifying to audit against the CSA PLA Code of Practice can take a deep dive."
* ''CCSK Foundation Training''+++*[»]> https://cloudsecurityalliance.org/education/ccsk/ === (Nov. 18) (€870)
** This class provides students a comprehensive 1-day review of cloud security fundamentals and prepares them to take the CCSK exam. Starting with a detailed description of cloud computing, the course covers all major domains in CSA's "Security Guidance for Critical Areas of Focus in Cloud Computing v4.0"+++*[»]> https://cloudsecurityalliance.org/guidance/ === and the recommendations from the European Network and Information Security Agency. This class is geared toward security professionals but is also useful for anyone looking to expand their knowledge of cloud security. The class fee includes the cost of the exam voucher, a €357.26 (US$395) value.
* ''Cloud Governance & Compliance Training''+++*[»]> https://knowledge.cloudsecurityalliance.org/cloud-governance-compliance=== (Nov. 19) (€785)
** The "Cloud Governance & Compliance" (CGC) training is a 1-day course on tools and mechanisms for governance and compliance and has a specific focus on the CSA Cloud Control Matrix, CSA's cloud security control framework. The CCM is specifically designed to provide fundamental security principles that guide cloud service vendors toward the most secure practices and to assist prospective cloud customers in assessing the overall security posture of cloud providers.
* ''GDPR Lead Auditor Training Course'' (Nov. 18-19) (€2,000).
** This training is specifically designed to instruct and certify internal and third-party auditors on how to audit against the requirements of the "CSA PLA Code of Practice"+++*[»]> https://gdpr.cloudsecurityalliance.org/resource/csa-code-of-conduct-for-gdpr-compliance/ ===, the CSA technical specification for GDPR compliance, and its related certification and code of conduct (CoC). Among the areas covered are:
*** __GDPR Fundamentals and CSA CoC:__ Objectives, Scope and Methodology
*** __CoC Controls 1-5:__ CSP declaration of compliance & accountability, CSP relevant contacts, ways in which data will be processed, recordkeeping and data transfer
*** __CoC Controls 6-10:__ data security, monitoring, personal data breach, data portability & migration, and restriction of processing
*** __CoC Controls 11-15:__ data retention/restitution/deletion, cooperation with the cloud customers, legally required disclosure, remedy for cloud customers and CSP insurance policy
*** __CoC Governance and Adherence Mechanisms__
//[img(25%,1px)[iCSF/BluePixel.gif]]
* Lien → ''[[CloudSecurityAlliance.fr/go/j9cc/|https://CloudSecurityAlliance.fr/go/j9cc/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Egregious 11 Meta-Analysis Part 3: Weak Control Plane and DoS//"
[>img(200px,auto)[iCSA/J9SBE.jpg]]Deuxième article de la série, publié le 12 septembre 2019 — Rédigé par Victor Chin, Research Analyst, CSA
<<<
//This is the ''third'' blog post in the series where we analyze the security issues in the new iteration of the Top Threats to Cloud Computing report. Each blog post features a security issue that is being perceived as less relevant and one that is being perceived as more relevant.

In this report, we found that traditional cloud security issues stemming from concerns about having a third-party provider are being perceived as less relevant. While more nuanced issues specific to cloud environments are being perceived as more problematic. With this in mind, we will be examining Shared Technology Vulnerabilities and Limited Cloud Usage Visibility further.
Please note that the Top Threats to Cloud Computing reports are not meant to be the definitive list of security issues in the cloud. Rather, the studies measures what industry experts perceive the key security issues to be.

__''Weak Control Plane''__
Weak control plane featured at the 8th position in the latest iteration of the Top Threats to Cloud Computing report. A weak cloud control plane refers to when a cloud service does not provide adequate or sufficient security controls to meet the security requirements of the customer. One example of a weak control plane is the lack of two-factor authentication and the ability to enforce its usage. Like the other debuting security issues, a weak control plane is something that a customer might only realize after they have migrated to the cloud. 

__A key difference between traditional IT and Cloud__
A key difference between traditional IT and cloud service applications that might help explain why weak control planes are becoming a problem in cloud services. In traditional IT environments, customer-controlled applications and their security features were designed with the customer as the main user. The application is hosted on the customer's infrastructure and configured by the customer. The customer has full visibility and control over the application and is thus also responsible for its security. The main role of the IT provider would be to continually provide patches or updates to the application to ensure that bugs and vulnerabilities are fixed.
The situation for cloud services is different because the cloud service is never fully 'shipped off' to the customer. The cloud service will always be hosted by the cloud service provider. Hence, they not only have to design a suite of security controls in the cloud service that is useable by their customers. They also have to consider the security mechanism and features that protect the cloud service and the virtual infrastructure that hosts it. Furthermore, due to the nature of cloud services, customers generally cannot use their security tools or technologies to augment the cloud service (i.e. filtering incoming network traffic). Both sets of security controls must meet the security, regulatory and compliance requirements of their various customers. With increasingly more enterprises adopting a 'cloud-first' policy, cloud service providers are faced with the situation of satisfying various technical security requirements of their many customers. Hence, it is not surprising that some enterprises might find the current security controls inadequate for their business needs. 

__Fulfilling regulatory and security requirements__
To sidestep such issues, prospective customers have to do their due diligence when considering cloud migration. Customers have to ensure that the cloud services they wish to use can fulfill their regulatory and security requirements. Prospective cloud customers can use the Cloud Security Alliance's Consensus Assessment Initiative Questionnaire (CAIQ)[2] to that end. The CAIQ is aligned with the Cloud Controls Matrix (CCM) and helps document what security controls exist in IaaS, PaaS and SaaS offerings, providing security control transparency. Furthermore, after cloud migration, customers should continue to monitor their regulatory and compliance landscape and communicate any changes to the cloud service providers. Having an open communication channel helps ensure that cloud service providers can make timely changes to the cloud service to align with changing customer security, compliance, and regulatory requirements.

__''Denial of Service''__
Denial of Service was rated 8th and then 11th in the last two iterations of the Top Threats report. In the latest Egregious 11 report, Denial of Service has dropped off the list. Denial of Service can take many forms. It can refer to a network attack such as a Distributed Denial of Service (DDoS) attack or system failure caused by a system administrator. 

Denial of Service (like many other security issues that have dropped off the list), is a security concern stemming from the fact that cloud services are a form of third-party in nature. In the early days of cloud computing, it was natural that enterprises were concerned about service availability when considering cloud migration. These enterprises had valid concerns about the cloud service providers' network bandwidth as well as their compute and storage capacities. However, over the years, cloud service providers have significantly invested in their infrastructure and now have almost unrivaled bandwidth and processing capabilities. At the same time, cloud service providers have built sophisticated DDoS protection for their customers. For example, Amazon Web Services (AWS) has AWS Shield[3], Microsoft Azure as Azure DDoS Protection[4] and Google Cloud Platform (GCP) has Google Cloud Armor[5].

In spite of all the infrastructure investment and the tools available to help customers mitigate DDoS attacks, other forms of denial of service can still happen. These denial of service incidents are often not malicious but rather occur due to mistakes by the cloud service provider. For example, in May 2019, Microsoft Azure and Office 365 experienced a three-hour outage due to a DNS configuration blunder[6]. Unfortunately, no amount of infrastructure investment or tools can prevent such incidents from happening. Customers have to realize that by migrating to the cloud, they are relishing full control of certain aspects of their IT. They have to trust that the cloud service provider has put in place the necessary precautions to reduce, as much as possible, the occurrence of such incidents.//
[...]
[1] https://cloudsecurityalliance.org/artifacts/top-threats-to-cloud-computing-egregious-eleven
[2] https://cloudsecurityalliance.org/artifacts/consensus-assessments-initiative-questionnaire-v3-0-1/
[3] https://aws.amazon.com/shield/
[4] https://docs.microsoft.com/en-us/azure/virtual-network/ddos-protection-overview
[5] https://cloud.google.com/armor/
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/j9ce/]] sur le blog de la CSA.
!"//Open API Survey Report//"
[>img(200px,auto)[iCSA/J9BBO.jpg]]Publié le 11 septembre 2019 — Rédigé par l'__Open API CSA Working Group__
<<<
//Cloud Security Alliance completed its first-ever Open API Survey Report, in an effort to see exactly where the industry stood on the knowledge surrounding Open APIs as well as how business professionals and consumers were utilizing them day to day. The key traits taken from the survey will be noted within this blog post to give the reader an idea of our current state of Open API knowledge and function. Moving forward, source code for security and open platforms has become increasingly shareable. As source code becomes more shareable between companies, it is giving way to new and robust manners which can be leveraged to improve upon what we already know. 
The survey was meant to be used as a means to see:
* What the outlook and future of Open API's are
* The gaps we can notice from people actually using them
* How they can become more useful for better security posture and development 
* How Open APIs can be used for emerging technologies. 

Interoperability is key within this survey. Businesses like the idea of using Open-API's because of their ability to work with systems already in place, and the ability to edit them to specific needs of a business. However, with this comes a lack of common education on where to go for implementing them, or how their security functions work internally from the original source. 

[<img(400px,auto)[iCSA/J9BB1.png]]Unfolding within this survey, however, was one thing that stood out the most among all of the questions and answers. Was anyone aware of best practices guide concerning Open APIs? The number was quite staggering, with 84% saying no. This immediately raises a red flag. The one thing we are using the most within development lifecycles and to build new products, doesn't have a well-known guidance supporting its usage and implementation into business models. 

As we move towards a future of open banking and other items that will be played at the hand of Open APIs, it is noticed that 44.74% of respondents to this survey have already implemented some form of an Open API. 

[>img(400px,auto)[iCSA/J9BB2.png]]The Open API platforms businesses are currently using or planning to use in the future were Key management/organization with 28%, and Open API Universal banking (PSD2) coming in a very close second. With the growth of online banking, however, this number for Universal Banking is more than likely going to grow the most in the coming years compared to other areas of specific interest. 

Building off of this question, we next asked if SaaS apps have proper security guarding them. 57% of the responses answered No. Of those 57% who answered No, 40% answered that they already have implemented Open API within their own workspace. Being already familiar with the existence of an Open API, we can confidently assume that security posture with SaaS apps are lacking security features. Because of the free availability of these programs, this can be looked at as no single guideline for secure functions being implemented through each use of a specific API. Lack of guideline and security input from development teams is a vital part of this missing function. 

[<img(400px,auto)[iCSA/J9BB3.png]]A staggering 94% responded "Yes" that security vendors should, in fact, be maintaining the Open-API's for SaaS vendors in an effort to push real-time updates. Half of that group is within the category of also already having a strong implementation of currently used open- API's, which also has suggested that the biggest benefit to their organization is interoperability. 

Something to note from this data set specifically, is that of all of the "yes" answers above are presently split down the middle that the future of Open API's in speaking to security will lie more dominantly in the IoT devices and B2C/AI categories. 

According to the study:
* 71% – Lack of knowledge on how to get started with Open API framework
* 89% – Not enough information on securing Open API's
* 73% – Not enough information on how to implement Open API's or where to look for a checklist for security posture. 

These all flow together to form a larger picture –> "How do we do this and where do we go?" A lack of guidance and policy surrounding these items is creating confusion beyond just implementing different open API's. 

[>img(400px,auto)[iCSA/J9BB4.png]]We had our respondents rate the best to the worst for organizations to implement security across SaaS vendors which included forward and reverse proxies, webhook integration, and other. As you can see from the image above, forward and reverse proxy scored 22% within the category as being the worst choice (1). Looking at the rows from 1 to 5, webhooks framework yielded the highest positive average ratio for the best choice for implementing security across SaaS vendors. 

It is important to note that webhook integration was the strongest choice for security posture and integration into a business environment. Though there were only 13% saying that they strongly agree, 52% were able to agree that a webhook integration is critical to the expansion of an existing framework. Of that group of 52%, more than 60% of their organizations either are working with universal banking initiatives or key management. 

There is much left to be developed within the realm of securing Open APIs and giving the reigns to who should actually be responsible for such a job. With Universal Banking becoming dominant internationally and moving into North America, the focus needs to shift to the idea of an interoperable and flexible framework that can give enterprises a knowledge base for building their programming architecture outwards.//
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/j9bo/]] sur le blog de la CSA.
!"CSA's Certificate of Cloud Security Knowledge Exam Is Now Covered Under the U.S. Dept. of Veterans Affairs GI Bill™"
<<<
[>img(auto,100px)[iCSA/J73CCSK.png]]//Eligible U.S. Veterans can now take advantage of opportunity to deepen their cloud security knowledge as part of GI Bill's educational benefits

SEATTLE – September 10, 2019 – The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today announced that the cost of the Certificate of Cloud Security Knowledge (CCSK) exam is now covered under the U.S. Department of Veterans Affairs GI Bill®, meaning that eligible U.S. Veterans and qualifying family members will be reimbursed for the full cost of the exam.

Called the "mother of all cloud computing certifications" by CIO.com, the vendor-neutral CCSK tests for a broad foundation of cloud security knowledge, covering such topics as architecture, governance, compliance, operations, encryption, and virtualization and serves as the foundation for those seeking to demonstrate a deep-seated knowledge and competency with cyber, information, software and cloud computing infrastructure security.

"As enterprises and consumers move greater amounts of sensitive information to the cloud, employers are struggling to find information security leaders who have the necessary breadth and depth of knowledge to establish cloud security programs that protect sensitive information," said Jim Reavis, Co-founder and CEO, Cloud Security Alliance. "We are extremely proud to be able to offer U.S. Veterans the opportunity to further, or even launch, their careers in an exciting and growing field with high demand for qualified professionals."

"There is a tremendous skills gap when it comes to cloud-savvy, information security professionals," said Ryan Bergsma, Training Program Director, CSA. "The CCSK certificate is widely recognized as the standard of cloud security expertise and is the natural next step for those who are looking to learn how to best secure data in the cloud."

Demonstrated expert knowledge of cloud computing and associated security issues is very valuable both to the expert and to our nation. The U.S. military and the organizations who serve its mission have a strong need for these skills. Increasingly, cloud computing and cloud security are vital to national security. Individuals who have this expertise can expect to have a direct impact to our national security and to have additional career opportunities.

Since it was launched in 2010, thousands of IT and security professionals have upgraded their skillsets and enhanced their careers by obtaining the CCSK.Among the benefits of earning the CCSK are:

* Proven competency in key cloud security issues through an organization that specializes in cloud research
* Increased employment opportunities by filling the skills-gap for cloud-certified professionals
* Demonstrated technical knowledge, skills, and abilities to effectively use controls tailored to the cloud
* Ability to establish a baseline of security best practices when dealing with a broad array of responsibilities, from cloud governance to configuring technical security controls
* Serves as a complement to other credentials

The CCSK exam body of knowledge is the CSA Security Guidance v4, the CSA Cloud Control Matrix and the ENISA Cloud Computing Risk Assessment report. Those interested in taking the exam can take advantage of a variety of training programs available through CSA, from free self-study prep courses and self-paced online courses to in-person training sessions and instructor-led online classes.

Since 1944, the GI Bill has helped qualifying Veterans and their family members pay for all or some of the costs associated with college, graduate school and professional training. Now eligible Veterans can receive reimbursement of up to $2,000 per test (but not more than the VA-approved cost of the test) and receive benefits if they need to retake it. Those seeking reimbursement will need to provide the name of the exam (CCSK), the date the test was taken, the exam fee ($395), a copy of their test results (visit https://ccsk.cloudsecurityalliance.org/en/attempts and click on the given test result), and CSA's address (1151 Ellis Street, Bellingham, WA 98225), along with personal information listed here.

GI Bill® is a registered trademark of the U.S. Department of Veterans Affairs (VA). More information about education benefits offered by VA is available at the official U.S. government Web site at https://www.benefits.va.gov/gibill.//
[img(25%,1px)[iCSF/BluePixel.gif]]
* Lien → ''[[CloudSecurityAlliance.fr/go/j9ak/|https://CloudSecurityAlliance.fr/go/j9ak/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(100px,auto)[iCSA/CCM.png]]Un appel à commentaires a été lancé pour la relecture de la traduction de la ''CCM'' réalisée par le CSA.
La date de cloture est le 2 octobre 2019.
<<<
//Cloud Security Alliance (CSA) would like to invite you to review and comment on the translated version of the Cloud Control Matrix (CCM) v3.0.1. CSA in the context of an agreement with OneTrust has proceeded towards the translation of the CCM in 10 languages in order to facilitate its easier adoption by organizations at the corresponding countries.
Provided translations are in the following languages:
* Spanish (ES), German (DE), ''French (FR)'', Italian (IT), Japanese (JA), Danish (DA), Dutch (NL), Portuguese (PT), Romanian (RO), Swedish (SV).
To provide your comments (right click on cell + add comment). The objective of the review is to make sure that the terminology and semantics of controls' specifications within the aforementioned tools are maintained per each provided translation set of languages.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j99c/|https://cloudsecurityalliance.fr/go/j99c/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(100px,auto)[iCSA/CAIQ301.png]]Un appel à commentaires a été lancé pour la relecture de la traduction de la ''CAIQ'' réalisée par le CSA.
La date de cloture est le 2 octobre 2019.
<<<
//Cloud Security Alliance (CSA) would like to invite you to review and comment on the translated version of the Consensus Assessments Initiative Questionnaire (CAIQ) v3.0.1. CSA in the context of an agreement with OneTrust has proceeded towards the translation of the aforementioned tools in 10 languages in order to facilitate their easier adoption by organizations at the corresponding countries.
Provided translations are in the following languages:
* Spanish (ES), German (DE), ''French (FR)'', Italian (IT), Japanese (JA), Danish (DA), Dutch (NL), Portuguese (PT), Romanian (RO), Swedish (SV).
To provide your comments (right click on cell + add comment). The objective of the review is to make sure that the terminology and semantics of controls' specifications within the aforementioned tools are maintained per each provided translation set of languages.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j99q/|https://cloudsecurityalliance.fr/go/j99q/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(300px,auto)[iCSA/CSAGDPRCoC.jpg]]Un appel à commentaires a été lancé pour la relecture de la traduction de la ''CAIQ'' réalisée par le CSA.
La date de cloture est le 2 octobre 2019.
<<<
//Cloud Security Alliance (CSA) would like to invite you to review and comment on the translated version of the Privacy Level Agreement Code of Conduct (PLA CoC) v3.1. CSA in the context of an agreement with OneTrust has proceeded towards the translation of the aforementioned tools in 10 languages in order to facilitate their easier adoption by organizations at the corresponding countries.
Provided translations are in the following languages:
* Spanish (ES), German (DE), ''French (FR)'', Italian (IT), Japanese (JA), Danish (DA), Dutch (NL), Portuguese (PT), Romanian (RO), Swedish (SV).
To provide your comments (right click on cell + add comment). The objective of the review is to make sure that the terminology and semantics of controls' specifications within the aforementioned tools are maintained per each provided translation set of languages.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j99p/|https://cloudsecurityalliance.fr/go/j99p/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!1 - Les nouveautés CSA de la semaine du 1^^er^^ au 8 septembre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Actu : Annonce du programme du ''Congrès CSA EMEA'' du 11 au 21 Novembre à Berlin+++*[»]> <<tiddler [[2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]>>=== 
* Blog : ''How to Share the Security Responsibility Between the CSP and Customer''+++*[»]> <<tiddler [[2019.09.05 - Blog : How to Share the Security Responsibility Between the CSP and Customer]]>>=== 
* Publication : ''STAR Level and Scheme Requirements''+++*[»]> <<tiddler [[2019.09.04 - Publication : STAR Level and Scheme Requirements]]>>=== 
* Actu: Appel à commentaires, document ''Software-Defined Perimeter as a DDoS Prevention Mechanism''+++*[»]> <<tiddler [[2019.08.19 - Actu : Appel à commentaires, document 'Software-Defined Perimeter as a DDoS Prevention Mechanism']]>>=== (dernière semaine)
!2 - Veille Web
La [[Veille Web|2019.09.08 - Veille Hebdomadaire]] avec plus de 60 liens :
* __''À lire'' :__ rapport CyberCube & Guy Carpenter "''Looking Beyond the Clouds: A US Cyber Insurance Industry Catastrophe Loss Study''"+++*[»]>
|2019.09.05|//CyberCube//|![[Guy Carpenter and CyberCube Report Reveals Potential Impact of Cyber Catastrophe Scenarios on U.S. Cyber Insurance Industry|https://www.cybcube.com/2019/09/guy-carpenter-licenses-first-of-its-kind-cyber-risk-modeling-platform-from-cybercube-following-strategic-alliance-2/]]|Report Major_Outage|
|2019.09.05|//CyberCube//|Rapport "[[Looking Beyond the Clouds: A U.S. Cyber Insurance Industry Catastrophe Loss Study|https://go.guycarp.com/lookingbeyondtheclouds]]|Report Major_Outage|
|2019.09.06|InfoSecurity Mag| → [[Catastrophic Incident at OS Provider Could Cost US Insurers $24bn|https://www.infosecurity-magazine.com/news/catastrophic-incident-os-cost-us/]]|Report Major_Outage|
=== 
* Pannes : ''AWS''+++*[»]>
|2019.09.04|The Register|[[AWS celebrates Labor Day weekend by roasting customer data in US-East-1 BBQ|https://www.theregister.co.uk/2019/09/04/aws_power_outage_data_loss/]]|Outage AWS|
|2019.09.04|Bleeping Computer| → [[Amazon AWS Outage Shows Data in the Cloud is Not Always Safe|https://www.bleepingcomputer.com/news/technology/amazon-aws-outage-shows-data-in-the-cloud-is-not-always-safe/]]|Outage AWS|
=== 
* Rapports et sondages : ''CyberCube''+++*[»]>
|2019.09.05|//CyberCube//|![[Guy Carpenter and CyberCube Report Reveals Potential Impact of Cyber Catastrophe Scenarios on U.S. Cyber Insurance Industry|https://www.cybcube.com/2019/09/guy-carpenter-licenses-first-of-its-kind-cyber-risk-modeling-platform-from-cybercube-following-strategic-alliance-2/]]|Report Major_Outage|
|2019.09.05|//CyberCube//|Rapport "[[Looking Beyond the Clouds: A U.S. Cyber Insurance Industry Catastrophe Loss Study|https://go.guycarp.com/lookingbeyondtheclouds]]|Report Major_Outage|
|2019.09.06|InfoSecurity Mag| → [[Catastrophic Incident at OS Provider Could Cost US Insurers $24bn|https://www.infosecurity-magazine.com/news/catastrophic-incident-os-cost-us/]]|Report Major_Outage|
===, ''McKinsey''+++*[»]>
|2019.09.06|//McKinsey//|![[Securing software as a service|https://www.mckinsey.com/business-functions/risk/our-insights/Securing-software-as-a-service]]|Survey McKinsey SaaS|
===, ''Netwrix''+++*[»]>
|2019.09.05|//Netwrix//|[[2019 Netwrix Cloud Data Security Report|https://www.netwrix.com/2019cloudsecurityreport.html]]|Report Netwrix|
|2019.09.02|//Netwrix//| → [[Netwrix Survey: 98% of Educational Institutions Are Not Hiring Dedicated Staff to Improve Cloud Security|https://vmblog.com/archive/2019/09/05/netwrix-survey-98-of-educational-institutions-are-not-hiring-dedicated-staff-to-improve-cloud-security.aspx]]|Report Netwrix|
|2019.09.02|//Netwrix//[>img[iCSF/flag_fr.png]]| → [[Enquête Netwrix : 98 % des établissements d'enseignement n'engagent pas de personnel spécialisé pour améliorer la sécurité du cloud|http://www.globalsecuritymag.fr/Enquete-Netwrix-98-des,20190905,90448.html]]|Report Netwrix|
===, ''Nominet''+++*[»]>
|2019.09.04|//Nominet//|Sondage [[Cyber-Security and the Cloud|https://nominetcyber.com/cyber-security-and-the-cloud/]]|Survey Nominet|
|2019.09.04|VMblog| → [[CISOs now think cloud is safer than on-premise, but security fears remain|https://vmblog.com/archive/2019/09/03/cisos-now-think-cloud-is-safer-than-on-premise-but-security-fears-remain.aspx]]|Survey Nominet|
|2019.09.04|Dark Reading| → [[Multicloud Businesses Face Higher Breach Risk|https://www.darkreading.com/cloud/multicloud-businesses-face-higher-breach-risk/d/d-id/1335719]] ([[rapport|]])|Survey Nominet|
===, ''Spanning''+++*[»]>
|2019.09.05|//Spanning//|[[2019 Cloud and Disaster Recovery Survey: 3 Key Takeaways|https://spanning.com/blog/2019-cloud-disaster-recovery-survey-3-key-takeaways/]] ([[rapport PDF|https://spanning.com/downloads/Spanning-Report-Unitrends-Survey-2019-Growing-Usage-SaaS-Data-Protection.pdf]])|Report Spanning DRP|
=== 
* Piratages et fuites de données : fuite de données de Monster+++*[»]>
|2019.09.05|TechCrunch|[[Monster.com says a third party exposed user data but didn't tell anyone|https://techcrunch.com/2019/09/05/monster-exposed-user-data-years/]]|DataLeak Monster|
|2019.09.05|Silicon Angle| → [[Monster.com user resumes exposed on misconfigured cloud server|https://siliconangle.com/2019/09/05/monster-com-user-resumes-exposed-misconfigured-third-party-server/]]|DataLeak Monster|
===, utilisation de Cloudflare Workers par le malware Astaroth+++*[»]>
|2019.09.01|Medium|[[Threat Actor behind Astaroth is now using Cloudflare Workers to bypass your Security Solutions|https://medium.com/@marcelx/threat-actor-behind-astaroth-is-now-using-cloudflare-workers-to-bypass-your-security-solutions-2c658d08f4c]]|Cloudflare Malicious_Infrastructure|
|2019.09.01|Bleeping Computer| → [[Astaroth Trojan Uses Cloudflare Workers to Bypass AV Software|https://www.bleepingcomputer.com/news/security/astaroth-trojan-uses-cloudflare-workers-to-bypass-av-software/]]|Cloudflare Malicious_Infrastructure|
=== 
* Divers : AWS et segmentation réseau, réflexions sur les challenges du Cloud Security Posture Management, décommissionnement dans le Cloud
!3 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Septembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.09.06|
|2019.09.06|NTP Pool|[[NTP Pool servers on Kubernetes on Packet|https://news.ntppool.org/2019/09/ntp-pool-servers-on-kubernetes-on-packet/]]|Kubernetes NTP|
|2019.09.06|GovLoop|[[1st Federal CISO: I'm 'very uncomfortable' with DoD's JEDI Cloud|https://www.govloop.com/1st-federal-ciso-im-very-uncomfortable-with-dods-jedi-cloud/]]|Government JEDI|
|2019.09.06|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[Face au cloud, les RSSI gardent leurs distances|https://www.lemondeinformatique.fr/actualites/lire-face-au-cloud-les-rssi-gardent-leurs-distances-76344.html]]|Governance|
|2019.09.06|//AppDynamics//|[[Slowdown is the New Outage (SINTO)|https://www.appdynamics.com/blog/aiops/slowdown-new-outage-sinto/]]|Outage|
|2019.09.06|//Blissfully//|![[SaaS App Deprovisioning Checklist to Keep Your Company Secure|https://www.blissfully.com/blog/saas-app-deprovisioning-checklist/]]|SaaS Deprovisioning|
|2019.09.06|//McKinsey//|![[Securing software as a service|https://www.mckinsey.com/business-functions/risk/our-insights/Securing-software-as-a-service]]|Survey McKinsey SaaS|
|>|>|>|!2019.09.05|
|2019.09.02|Sécurité & Défense Mag[>img[iCSF/flag_fr.png]]|[[Les enjeux stratégiques du Cloud de confiance|https://sd-magazine.com/securite-numerique-cybersecurite/les-enjeux-strategiques-du-cloud-souverain]]|Sovereign_Cloud|
|2019.09.05|TechCrunch|[[Monster.com says a third party exposed user data but didn't tell anyone|https://techcrunch.com/2019/09/05/monster-exposed-user-data-years/]]|DataLeak Monster|
|2019.09.05|Silicon Angle| → [[Monster.com user resumes exposed on misconfigured cloud server|https://siliconangle.com/2019/09/05/monster-com-user-resumes-exposed-misconfigured-third-party-server/]]|DataLeak Monster|
|2019.09.05|NHS|[[NHS SBS launches cloud procurement framework|https://www.ukauthority.com/articles/nhs-sbs-launches-cloud-procurement-framework/]]|Procurement|
|2019.09.05|NHS| → [[Cloud Solutions framework|https://www.sbs.nhs.uk/fas-cloud-solutions]]|Procurement|
|2019.09.05|JDSupra|[[The Systemic Importance of Cloud-Based Service Providers to Banks|https://www.jdsupra.com/legalnews/the-systemic-importance-of-cloud-based-96893/]]|Storage|
|2019.09.05|//CyberCube//|![[Guy Carpenter and CyberCube Report Reveals Potential Impact of Cyber Catastrophe Scenarios on U.S. Cyber Insurance Industry|https://www.cybcube.com/2019/09/guy-carpenter-licenses-first-of-its-kind-cyber-risk-modeling-platform-from-cybercube-following-strategic-alliance-2/]]|Report Major_Outage|
|2019.09.05|//CyberCube//|Rapport "[[Looking Beyond the Clouds: A U.S. Cyber Insurance Industry Catastrophe Loss Study|https://go.guycarp.com/lookingbeyondtheclouds]]|Report Major_Outage|
|2019.09.06|InfoSecurity Mag| → [[Catastrophic Incident at OS Provider Could Cost US Insurers $24bn|https://www.infosecurity-magazine.com/news/catastrophic-incident-os-cost-us/]]|Report Major_Outage|
|2019.09.05|//Netwrix//|[[2019 Netwrix Cloud Data Security Report|https://www.netwrix.com/2019cloudsecurityreport.html]]|Report Netwrix|
|2019.09.02|//Netwrix//| → [[Netwrix Survey: 98% of Educational Institutions Are Not Hiring Dedicated Staff to Improve Cloud Security|https://vmblog.com/archive/2019/09/05/netwrix-survey-98-of-educational-institutions-are-not-hiring-dedicated-staff-to-improve-cloud-security.aspx]]|Report Netwrix|
|2019.09.02|//Netwrix//[>img[iCSF/flag_fr.png]]| → [[Enquête Netwrix : 98 % des établissements d'enseignement n'engagent pas de personnel spécialisé pour améliorer la sécurité du cloud|http://www.globalsecuritymag.fr/Enquete-Netwrix-98-des,20190905,90448.html]]|Report Netwrix|
|2019.09.05|//Alibaba//|[[Kubernetes Pod Disruption Budgets (PDB)|https://medium.com/@Alibaba_Cloud/kubernetes-pod-disruption-budgets-pdb-1aeaf2a97f05]]|Kubernetes|
|2019.09.05|//CyberArk//|[[Attacking the Cluster Remotely|https://www.cyberark.com/threat-research-blog/kubernetes-pentest-methodology-part-2/]] (2/3)|Kubernetes PenTest|
|2019.09.05|//Spanning//|[[2019 Cloud and Disaster Recovery Survey: 3 Key Takeaways|https://spanning.com/blog/2019-cloud-disaster-recovery-survey-3-key-takeaways/]] ([[rapport PDF|https://spanning.com/downloads/Spanning-Report-Unitrends-Survey-2019-Growing-Usage-SaaS-Data-Protection.pdf]])|Report Spanning DRP|
|2019.09.05|//Motley Fool//|[[FireEye's Significant Challenges Despite its Growing Cloud Business|https://www.fool.com/investing/2019/09/05/fireeyes-significant-challenges-despite-its-growin.aspx]]|Trends|
|2019.09.05|//Arcserve//|[[Hybrid or Multi-cloud? Picking the Right Cloud Strategy for an Organization's IT Needs|https://cloudtweaks.com/2019/09/hybrid-or-multi-cloud-strategy/]]|Hybrid_Cloud Multi_Cloud|
|2019.09.05|//PaloAlto Networks//|[[The Zero Trust Approach for the Cloud|https://blog.paloaltonetworks.com/2019/09/cloud-zero-trust-approach/]]|Zero_Trust|
|2019.09.02|//Google//[>img[iCSF/flag_fr.png]]|[[Gouvernance des données dans le cloud : comment l'aborder|http://www.globalsecuritymag.fr/Gouvernance-des-donnees-dans-le,20190905,90461.html]]|Governance Data|
|>|>|>|!2019.09.04|
|2019.09.04|//Nominet//|Sondage [[Cyber-Security and the Cloud|https://nominetcyber.com/cyber-security-and-the-cloud/]]|Survey Nominet|
|2019.09.04|VMblog| → [[CISOs now think cloud is safer than on-premise, but security fears remain|https://vmblog.com/archive/2019/09/03/cisos-now-think-cloud-is-safer-than-on-premise-but-security-fears-remain.aspx]]|Survey Nominet|
|2019.09.04|Dark Reading| → [[Multicloud Businesses Face Higher Breach Risk|https://www.darkreading.com/cloud/multicloud-businesses-face-higher-breach-risk/d/d-id/1335719]] ([[rapport|]])|Survey Nominet|
|2019.09.04|Continuity Central| → [[Cloud is safer than on-premise say that majority of security leaders|https://www.continuitycentral.com/index.php/news/technology/4384-cloud-is-safer-than-on-premise-say-that-majority-of-security-leaders]]|Survey Nominet|
|2019.09.04|CloudTech| → [[Cloud security woes strike again - and it's double trouble for multi-cloud users, research finds|https://www.cloudcomputing-news.net/news/2019/sep/04/cloud-security-woes-strike-again-and-its-double-trouble-multi-cloud-users-research-finds/]]|Survey Nominet|
|2019.09.04|Redmond|[[Microsoft Azure and Office 365 Services Go Down in Texas Service Area|https://redmondmag.com/articles/2018/09/04/azure-office-365-down-in-texas.aspx]]|Outage Azure O365|
|2019.09.04|The Register|[[AWS celebrates Labor Day weekend by roasting customer data in US-East-1 BBQ|https://www.theregister.co.uk/2019/09/04/aws_power_outage_data_loss/]]|Outage AWS|
|2019.09.04|Bleeping Computer| → [[Amazon AWS Outage Shows Data in the Cloud is Not Always Safe|https://www.bleepingcomputer.com/news/technology/amazon-aws-outage-shows-data-in-the-cloud-is-not-always-safe/]]|Outage AWS|
|2019.09.04|//StorageCraft//[>img[iCSF/flag_fr.png]]|[[Les entreprises rapatrient désormais leurs données depuis le cloud : mais où les stocker ?|https://www.journaldunet.com/solutions/expert/71655/les-entreprises-rapatrient-desormais-leurs-donnees-depuis-le-cloud---mais-ou-les-stocker.shtml]]|Storage|
|2019.09.04|//Vectra//|[[Security pros need more and better visibility into their cloud networks|https://www.helpnetsecurity.com/2019/09/04/cloud-networks-visibility/]]|Misc|
|2019.09.04|//Security Intelligence//|[[Making the Case for Network Segmentation in AWS|https://securityintelligence.com/posts/making-the-case-for-network-segmentation-in-aws/]]|AWS Segmentation|
|2019.09.04|//McAfee//|[[Securing Sensitive Data In the Cloud|https://www.skyhighnetworks.com/cloud-security-blog/securing-sensitive-data-in-the-cloud/]]|Insider_Threats|
|2019.09.04|//Optiv//|[[Service Providers and PCI Compliance, Part 1 – Cloud Services and Your Obligations|https://www.optiv.com/blog/service-providers-and-pci-compliance-part-1-cloud-services-and-your-obligations]] (1/3)|Compliance PCI_DSS|
|2019.09.04|//Smallstep//|[[Embarrassingly easy private certificate management for VMs on AWS, GCP, and Azure|https://smallstep.com/blog/embarrassingly-easy-certificates-on-aws-azure-gcp/]]|Certificates AWS Azure GCP|
|2019.09.04|//Microsoft//|[[Automated investigation and response (AIR) in Office 365|https://docs.microsoft.com/en-us/office365/securitycompliance/automated-investigation-response-office]]|O365 Investigations|
|2019.09.04|//StackRox//|[[5 Kubernetes RBAC Mistakes You Must Avoid|https://www.stackrox.com/post/2019/09/5-kubernetes-rbac-mistakes-you-must-avoid/]]|Kubernetes|
|>|>|>|!2019.09.03|
|2019.09.03|Christophe Parisel|[[Aftermath of the Capital One incident on AWS|https://www.linkedin.com/pulse/aftermath-capital-one-incident-aws-christophe-parisel/]]|CapitalOne Incident Lessons_Learnt|
|2019.09.03|Randy Westergren|[[A Closer Look at Recent HTTP/2 Vulnerabilities Affecting K8s and Other Implementations|https://randywestergren.com/a-closer-look-at-recent-http-2-vulnerabilities-affecting-k8s-and-other-implementations/]]|Kubernetes CVE-2019-9511→9518|
|2019.09.03|DevOps.com|[[From DevOps to DevSecOps: Owning Cloud Security|https://devops.com/from-devops-to-devsecops-owning-cloud-security/]]|DevSecOps|
|2019.09.03|CSO Online|[[ICS as a cloud service is coming: Will the benefits outweigh the risks?|https://www.csoonline.com/article/3434532/ics-as-a-service-icsaas-is-coming-will-the-benefits-outweigh-the-risks.html]]|ICS|
|2019.09.03|Solutions Review|[[The 12 Best Managed Cloud Security Services Providers|https://solutionsreview.com/cloud-platforms/the-12-best-managed-cloud-security-services-providers/]]|MSSP|
|2019.09.03|Infosec Institute|[[Should you take the CCSP/SSCP before the CISSP?|https://resources.infosecinstitute.com/should-you-take-the-ccsp-sscp-before-the-cissp/]]|Certification|
|2019.09.03|//Azure//|[[Reduce disaster recovery time with Azure Site Recovery|https://azure.microsoft.com/en-us/blog/reduce-disaster-recovery-time-with-azure-site-recovery/]]|DRP|
|2019.09.03|//ParkMyCloud//|[[How Much Should Enterprises Worry About Vendor Lock-in in Public Cloud?|https://www.parkmycloud.com/blog/vendor-lock-in/]]|Reversibility|
|2019.09.03|//Fugue//|![[Cloud Security Posture Management Challenge: Baselining vs. Scripts and Bots|https://www.fugue.co/blog/cloud-security-posture-management-challenge-baselining-vs.-scripts-and-bots]]|Security_Posture|
|2019.09.03|//Idaptive//|![[How to Prevent Office 365 Account Lockouts|https://www.idaptive.com/blog/Prevent-Office-365-Account-Lockouts/]]|O365|
|>|>|>|!2019.09.02|
|2019.09.02|MISC[>img[iCSF/flag_fr.png]]|[[L'édito de MISC n°105|https://www.miscmag.com/ledito-de-misc-n105/|]]|Governance|
|2019.09.02|CBR Online|[[Why the UK Government's Re-Evaluation of its Cloud First Policy is a Sign of the Times|https://www.cbronline.com/opinion/cloud-first-uk-govt]]|Government Strategy|
|2019.09.02|Bleeping Computer|[[Windows 10 Gets a Cloud Reset Feature, Here's How it Works|https://www.bleepingcomputer.com/news/microsoft/windows-10-gets-a-cloud-reset-feature-here-s-how-it-works/]]|Windows_10|
|2019.09.02|Silicon Angle|[[UK travel company exposes customer calls on misconfigured cloud storage|https://siliconangle.com/2019/09/02/uk-travel-company-exposes-customer-calls-misconfigured-cloud-storage/]]|AWS Data_Leak|
|2019.09.02|InfoQ|[[How to Use Chaos Engineering to Break Things Productively|https://www.infoq.com/articles/chaos-engineering-security-networking/]]|Chaos_Engineering|
|2019.09.02|Rick's Cloud|[[IoT and its impact on the business world - Part I|https://rickscloud.com/iot-and-its-impact-on-the-business-world-part-i/]]|IoT|
|2019.09.02|SilverLining|!Silver Lining podcast [[Chapter 7: Creating Trust in Cloud|https://silverlining.media/chapter-7-creating-trust-in-cloud/]]|Podcast|
|2019.09.02|//Compliant Cloud//|[[Where's my data gone?|https://compliantcloud.com/wheres-my-data-gone-data-integrity/]]|Integrity|
|2019.09.02|//Verizon//|[[Verizon White Paper: CISO's Guide to Cloud Security|http://rafeeqrehman.com/2019/09/02/verizon-white-paper-cisos-guide-to-cloud-security/]]|CISO|
|2019.09.02|//Compare The Cloud//|[[Why companies are ditching the cloud for hybrid|https://www.comparethecloud.net/articles/why-companies-are-ditching-the-cloud-for-hybrid/]]|Hybrid_Cloud|
|2019.09.02|//Fugue//|[[Why "Cloud Security 101" Isn't So Simple After All|https://www.cyberdefensemagazine.com/why-cloud-security-101/]]|Misc|
|2019.09.02|//Cloudbric//|[[My cloud WAF service provider suffered a data breach…how can I protect myself?|https://www.cloudbric.com/blog/2019/09/cloud-waf-service-provider-suffered-data-breach-protection/]]|DataBreach Imperva|
|>|>|>|!2019.09.01|
|2019.09.01|Medium|[[Threat Actor behind Astaroth is now using Cloudflare Workers to bypass your Security Solutions|https://medium.com/@marcelx/threat-actor-behind-astaroth-is-now-using-cloudflare-workers-to-bypass-your-security-solutions-2c658d08f4c]]|Cloudflare Malicious_Infrastructure|
|2019.09.01|Bleeping Computer| → [[Astaroth Trojan Uses Cloudflare Workers to Bypass AV Software|https://www.bleepingcomputer.com/news/security/astaroth-trojan-uses-cloudflare-workers-to-bypass-av-software/]]|Cloudflare Malicious_Infrastructure|
|2019.09.01|//Ctera//[>img[iCSF/flag_fr.png]]|[[Comment faire face à l'évolution constante des menaces de sécurité dans le Cloud (Ctera)|https://www.eurocloud.fr/faire-face-a-levolution-constante-menaces-de-securite-cloud-ctera/]]|Threats|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Septembre 2019]]>>
!"//How to Share the Security Responsibility Between the CSP and Customer//"
[>img(200px,auto)[iCSA/J82BC.jpg]]Publié le 5 septembre 2019 — Rédigé par Dr. Kai Chen, Chief Security Technology Officer, Consumer BG, Huawei Technologies Co. Ltd
<<<
//The behemoths of cloud service providers (CSPs) have released shared security responsibility related papers and articles, explaining their roles and responsibilities in cloud provisioning. Although they share similar concepts, in reality, there are different interpretations and implementations among CSPs.

While there are many cloud security standards to help guide CSPs in fulfilling their security responsibilities, the cloud customers still find it challenging to design, deploy, and operate a secure cloud service. "''Guideline on Effectively Managing Security Service in the Cloud''"+++*[»]> <<tiddler [[2019.01.04 - Publication : Guideline on Effectively Managing Security Service in the Cloud]]>>=== (referred to as the 'Guideline') developed by CSA's ''Cloud Security Services Management (CSSM) Working Group'' provides an easy-to-understand guidance for cloud customers. It covers how to design, deploy, and operate a secure cloud service for different cloud service models, namely IaaS, PaaS, and SaaS. Cloud customers can use it to help ensure the secure running of service systems.

In the Guideline, the shared security responsibility figure was developed with reference to Gartner's shared security responsibility model
{{floatC{
[img(600px,auto)[iCSA/J95B1.png]].
Staying Secure in the Cloud Is a Shared Responsibility, Gartner
→ https://www.gartner.com/doc/3277620/staying-secure-cloud-shared-responsibility
Security responsibility division between CSPs and cloud customers in different cloud service models.
}}}
It illustrates the security handoff points for IaaS, PaaS, and SaaS cloud models. The handoff point moves up the stack across the models.

While there are differences in the security responsibility across the models, some responsibilities are common to all cloud service models:

''CSPs' Common Security Responsibilities''
* Physical security of the infrastructure, including but not limited to: equipment room location selection; power supply assurance; cooling facilities; protection against fire, water, shock, and theft; and surveillance (for details about the security requirements, see related standards)
* Security of computing, storage, and network hardware
* Security of basic networks, such as anti-distributed denial of service and firewalls
* Cloud storage security, such as backup and recovery
* Security of cloud infrastructure virtualization, such as tenant resource isolation and virtualization resource management
* Tenant identity management and access control
* Secure access to cloud resources by tenant
* Security management, operating monitoring, and emergency response of infrastructure
* Formulating and rehearsing service continuity assurance plans and disaster recovery plans for infrastructure

''Cloud Customers' Common Security Responsibilities''
* User identity management and access control of service systems
* Data security (in the European General Data Protection Regulation (GDPR) mode, cloud customers control the data and should be responsible for data security while CSPs only process the data and should take security responsibilities granted by data controllers.)
* Security management and control of terminals that access cloud services, including hardware, software, application systems, and device rights
Besides that, the Guideline contains chapters that describe the technical requirements for the security assurance of cloud service systems and provides an implementation guide based on the existing security technologies, products, and services. It also illustrates security assurance technologies, products, and services that CSPs and customers should provide in different cloud service models as mentioned previously.
{{floatC{
[img(600px,auto)[iCSA/J95B2.png]]
Security responsibilities between CSPs and cloud customers
}}}
''Mapping of the Guideline with CCM''

To help provide an overview to end users about the similarities and differences between the security recommendations listed in the Guideline and the ''Cloud Controls Matrix'' (CCM) controls, the CSSM working group conducted a mapping of CCM version 3.0.1 to the Guideline.

The ''Mapping of "Guideline on Effectively Managing Security Service in the Cloud" Security Recommendations to CCM'' was a one-way mapping, using the CCM as base, done in accordance with the ''Methodology for the Mapping of the Cloud Controls Matrix''.

The mapping document is supplemented with a detailed ''gap analysis report'' that breaks down the gaps in each CCM domain and provides recommendations to readers.

"This mapping work brings users of the Guideline a step closer to being CCM compliant, beneficial to organizations looking to extrapolate existing security controls to match another framework, standard or best practice," said Dr. Chen Kai, Chief Security Technology Officer, Consumer BG, Huawei Technologies Co. Ltd., and chair of the CSSM Working Group.

Users of the Guideline will be able to bridge lacking areas with ease based on the gap analysis. By understanding what it takes to go from the Guideline to CCM, the mapping work complements the Guideline to help users achieve holistic security controls.

Download the gap analysis report on mapping to the CSA's Cloud Controls Matrix(CCM) now.

Learn more about the Cloud Services Management Working Group here.//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/09/05/how-to-share-the-security-responsibility-between-the-csp-and-customer/]] sur le blog de la CSA.
!"//Gap Analysis Report on Mapping CSA's Cloud Controls Matrix to 'Guideline on Effectively Managing Security Service in the Cloud'//"
[>img(200px,auto)[iCSA/J95PG.png]]Document publié le 5 septembre 2019.
<<<
//The report summarizes the mapping of CCM v3.0.1 to 'Guideline on Effectively Managing Security Services in the Cloud' and provides gap analysis on the results.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j95g/|https://CloudSecurityAlliance.fr/go/j95g/]]''
!"//Mapping of 'The Guidelines' Security Recommendations to CCM//"
Document publié le 5 septembre 2019.[>img(100px,auto)[iCSA/CSAdoc.png]]
<<<
//This document contains the additional controls that serves to bridge the gap between CCM V3.0.1 and the controls within 'Guideline on Effectively Managing Security Services in the Cloud' published by Cloud Security Services Working Group.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j95m/|https://CloudSecurityAlliance.fr/go/j95m/]]''
!"//STAR Level and Scheme Requirements//"
Document publié le 4 septembre 2019.
__Extrait :__
<<<
//CSA Security Trust, Assurance and Risk ([[STAR]]™) is the industry's most powerful program for security assurance in the cloud. STAR™ encompasses key principles of transparency, rigorous auditing, and harmonization of standards. The STAR™ program provides multiple benefits, including indications of best practices and validation of security posture of cloud offerings. STAR™ is based on the following foundation tools:
* The CSA Cloud Controls Matrix ([[CCM]])+++*[»]> <<tiddler [[CCM]]>>=== 
* The Consensus Assessments Initiative Questionnaire ([[CAIQ]])+++*[»]> <<tiddler [[CAIQ]]>>=== 
* The CSA Code of Conduct for GDPR Compliance+++*[»]> <<tiddler [[RGPD]]>>=== 
//[...]//
One of most essential features of the STAR™ program is its registry that documents the security and privacy controls provided by popular cloud computing offerings. This publicly accessible registry is designed for users of cloud services to assess their cloud providers, security providers and advisory and assessment services firms in order to make the best procurement decisions.//
<<<
__Table des matières__[>img(500px,auto)[iCSA/OCF-1.png]]
<<<
# STAR Introduction
# STAR Levels Overview
# Level 1
** STAR Self-Assessment
** GDPR CoC Self-Assessment (Privacy)
# Level 2
** CSA STAR Attestation
** CSA STAR Certification
** CSA C-STAR Assessment
** GDPR CoC Certification (Privacy)
# Level 3
** CSA STAR-Continuous
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j94s/|https://CloudSecurityAlliance.fr/go/j94s/]]''
[>img(300px,auto)[iCSA/JBICE.jpg]]La [[Cloud Security Alliance]] a annoncé le programme du prochain [[Congrès CSA EMEA|2019.11.20 - CSA Congress EMEA 2019 - Berlin]] qui se déroulera du 18 au 21 novembre 2019 à Berlin : "Cloud Security Alliance to Address Convergence of Privacy and Security at 2019 EMEA Congress".
<<<
//''__Andreas Könen__, __Udo Helmbrecht__, and __Pearse O'Donohue__ join thought leaders from BSI, European Privacy Association, Adobe, and Google Cloud as speakers''

Berlin, Germany - Sept. 4, 2019 - The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today announced the speaker line-up and session highlights for its upcoming CSA EMEA Congress (Berlin, Nov. 18-21, 2019). Headlining the event will be two of the most prominent cloud and Internet of Things (IoT) policy makers - __Andreas Könen__, Director General CI, Cyber and Information Security, German Federal Ministry of the Interior, Building and Community (BMI), and __Pearse O'Donohue__, Director, Future Networks Directorate, European Commission - DG CONNECT. __Udo Helmbrecht__. Executive Director, ENISA, will also be on hand and will speak to how cybersecurity certification can foster the EU cybersecurity market.

In his address - ''Cyber Security Act and IT-Security Law 2.0'' - Könen will discuss how developments in security labelling, emerging technologies and the expected rapid growth of the IoT have forced enterprises and governments to rethink security requirements and how to implement them and provide insights into the Cyber Security Act and the German IT Security Law 2.0.

This year's event will focus on two tracks - ''Cloud Privacy, Governance'', and ''Compliance and Best Practices in Cybersecurity'' - and offer attendees the chance to earn CPE credits. Over the course of two days, attendees will learn, among other things, how to:
* go beyond classic vendor risk-assessment practices and take advantage of continuous data-driven security intelligence methods
* real-world, practical advice on automating third-party privacy and security risk programs
* cut through the complexity of today's compliance with a multi-party recognition framework for cloud security

"This year's CSA EMEA Congress examines the convergence of security and privacy a little more than a year after the implementation of the General Data Protection Regulation. The event promises to offer attendees an in-depth examination of what we as cloud professionals have learned over the past 16 months as well as what technologies are shaping our industry's future," said __Daniele Catteddu__, Chief Technology Officer, Cloud Security Alliance.

Attendees will benefit from panels and presentations featuring companies leading the development of cutting-edge advancements in cloud security and data privacy, including:

# ''Cloud Computing Security in the NIS Directive''.
** Presenter: __Dr. Marnix Dekker__, Cybersecurity Expert, European Union Agency for Network and Information Security (ENISA)
# ''From Spreadsheets to Streamlined: Automating the Third-Party Vendor Risk Lifecycle''.
** Presenter: __Ian Evans__, Managing Director, OneTrust
# ''CSA Security Trust Assurance and Risk (STAR)''.
** Presenter: __Daniele Catteddu__, Chief Technology Officer, CSA
# ''How Cybersecurity Certification Can Foster the EU Cybersecurity Market''.
** Presenter: __Dr. Udo Helmbrecht__. Executive Director, ENISA
# ''The Community Draft of the Revised C5''.
** Presenter: __Dr. Patrick Grete__, Cloud Security Expert, Federal Office for Information Security (BSI)
# ''Trust in Cloud by Certification''.
** Presenter: __Damir Savanovic__, Senior Innovation Analyst, CSA
# ''Taking Control of IoT: An Enterprise Perspective''.
** Presenter: __Hillary Baron__, Research Analyst and Program Manager, CSA
# ''Track: Cloud Privacy, Governance and Compliance''
** ''Cloud Security Alliance Code of Conduct for GDPR Compliance''.
*** Presenter: __Paolo Balboni__, Founding Partner, ICT Legal Consulting, and President, European Privacy Association
** ''What's Up with Data Breaches Notifications Under the GDPR''.
*** Presenter: __Dorotea Alessandra De Marco__, Senior Official, Italian Data Protection Authority
** ''Trust but Verify''.
*** Presenter: __Gillian Hamilton__, Strategic Trust Lead, Google Cloud
** ''Bolster Your Incident Response Plan Across Privacy & Security Teams''.
*** Presenter: __Ian Evans__, Managing Director, OneTrust
** ''The GDPR and the NIS Directive One Year On: Security Obligations on Cloud Service Providers''.
*** Presenter: __Jenny Gershkovich__, Information Security Lead Vendor Security Services, ABN AMRO Bank N.V.
*** Presenter: __Isabella Oldani__, Research Coordinator, "Legal and Privacy in the Cloud" Cloud Security Alliance-Italian Chapter
*** Presenter: __Marco Tullio Giordano__, Attorney-at-law, Data Protection Officer and ISO27001 Lead Auditor
*** Presenter: __Massimo Simbula__, founder, Studio Legale Simbula Law Firm
# ''Track: Best Practices in Cybersecurity''
** ''Leveraging Osquery for DFIR at Scale''.
*** Presenter: __Sohini Mukherjee__, Security Researcher, Adobe
** ''Works Councils, Your Best Friends (Really!)''.
*** Presenter: __Mark Wijnhoven__, Global Legal and Privacy Lead, Phillips Group Security
** ''Using Cloud Services Securely - A Practical Viewpoint''.
*** Presenter: __Benoit Heynderickx__, Research Analyst, Information Security Forum
** ''How to Scale Vendor Security Management''.
*** Presenter: __Jenny Gershkovich__, Information Security Lead Vendor Security Services, ABN AMRO Bank N.V.
** ''Secure Cloud Adoption by Spanish Organizations''.
*** Presenter: __Mariano Benito__, CISO, GMV Soluciones Globales Internet Secure
** ''Digital Transformation Requires Security Transformation''.
*** Presenter: __Neil Thacker__, CISO EMEA, Netskope
** ''Cloud Octagon Model for SaaS Risk Assessments''.
*** Presenter: __Jim de Haas__, Cloud Security Wizard, ABN AMRO Bank
** ''Vendor Risk Assessment - A Discussion with Cloud Leaders'' (Panel).
*** Moderator: __Chris Niggel__, Director of Security and Compliance, Okta Vendor Risk Assessment
//
<<<
__Inscription :__
* Lien → https://www.eventbrite.co.uk/e/csa-emea-congress-2019-tickets-55612125364
* Inscription standard : 350 € jusqu'au 1^^er^^ novembre, frais de 20,24€
* Inscription tardive : 500 € du 2 au 21 novembre, frais de 28,49 €
* Etudiants et fonctionnaires : 50 €, frais de 3,75 €
* Formation "CCSK Foundation" : 870 €, frais de 48,84 €
* Formation "CGC" : 785 €, frais de 44,17 €
* Formation GDPR : 2.000 €, frais de 110,99 €
[img(25%,1px)[iCSF/BluePixel.gif]]
* Lien → ''[[CloudSecurityAlliance.fr/go/j94c/|https://cloudsecurityalliance.fr/go/j94c/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Announcing the Security@ San Francisco 2019 Agenda//"
[>img(100px,auto)[iCSA/J9PBA.jpg]]^^Publiée le 25 septembre 2019, l'annonce du programme de la conférence "Security@ San Francisco" du 15 octobre 2019
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/j9pb/]] sur le blog de la Cloud Security Alliance^^

!"//Glass Class: Three Essential Requirements for Securing IaaS//"
[>img(100px,auto)[iCSA/J94BS.jpg]]^^Bien que publié le 23 septembre 2019 sur le blog de la CSA, cet article l'a déjà été il y a 5 semaines, le 14 août 2019 sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/j9nz/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/j9nx/]]^^

!"//The Four Pillars of CASB: Data Protection//"
[>img(100px,auto)[iCSA/J9GBT.jpg]]^^Bien que publié le 16 septembre 2019 sur le blog de la CSA, cet article l'a déjà été il y a 3 semaines, le 26 août 2019 sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/j9gz/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/j9gx/]]^^

!"//Cloud Security Roadmap for 2019 & Beyond//"
[>img(100px,auto)[iCSA/J9ABC.jpg]]^^Bien que publié le 10 septembre 2019 sur le blog de la CSA, cet article l'a déjà été il y a une semaine, le 3 septembre 2019 sur le site de la société ExtraHop.
Il ne s'agit que d'une incitation à télécharger, après inscription, un rapport d'IDC intitulé ""//Cloud SecurityRoadMap: Identifying Limitations to the Shared Responsibility Model as well as Requirements and Best Practices//" et publié le 26 août 2019.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/j9az/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/j9ax/]]^^

!"//What Executives Should Know About the Capital One Breach//"
[>img(100px,auto)[iCSA/J99BW.jpg]]^^Bien que publié le 9 septembre 2019 sur le blog de la CSA, cet article l'a déjà été il y a 3 semaines, le 14 août 2019 sur le site de la société Fugue.
Il faisait partie des articles déjà mentionnés dans notre veille datée du 18 août 2019
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/j99z/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/j99x/]]^^

!"//Security Spotlight: iPhones Susceptible to a Hack via Text//"
[>img(100px,auto)[iCSA/J94BS.jpg]]^^Bien que publié le 4 septembre 2019 sur le blog de la CSA, cet article l'a déjà été il y a 2 semaines, le 21 août 2019 sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/j94z/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/j94x/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201908>>
<<tiddler fAll2Tabs10 with: VeilleM","_201908>>
<<tiddler fAll2LiTabs with: NewsL","201908>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Août 2019]]>>
|!Août|!Sources|!Titres et Liens|!Keywords|
|2019.08.13|Netflix|[[NFLX-2019-002: HTTP/2 Denial of Service Advisory|https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md]]|Kubernetes CVE-2019-9511→9518|
|2019.08.13|CERT/CC|[[VU#605641: HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion|https://www.kb.cert.org/vuls/id/605641/]]|Kubernetes CVE-2019-9511→9518|
||Mitre|Data Dribble→ [[CVE-2019-9511|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9511]]|Kubernetes|
||Mitre|Ping Flood → [[CVE-2019-9512|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512]]|Kubernetes|
||Mitre|Resource Loop → [[CVE-2019-9513|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9513]]|Kubernetes|
||Mitre|Reset Flood → [[CVE-2019-9514|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514 ]]|Kubernetes|
||Mitre|Settings Flood → [[CVE-2019-9515|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515 ]]|Kubernetes|
||Mitre|0-Length Headers Leak (Nginx variant) → [[CVE-2019-9516|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9516]]|Kubernetes|
||Mitre|Internal Data Buffering → [[CVE-2019-9517|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9517]]|Kubernetes|
||Mitre|Empty Frames Flood → [[CVE-2019-9518|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9518]]|Kubernetes|
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Août 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Août 2019]]>><<tiddler fAll2LiTabs with: Actu","201908>>
<<tiddler fAll2LiTabs with: Blog","201908>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Août 2019]]>>
<<tiddler fAll2LiTabs with: Publ","201908>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Août 2019]]>>
!1 - Les nouveautés CSA de la semaine du 26 au 31 août 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Egregious 11 Meta-Analysis Part 2: Virtualizing Visibility''+++*[»]> <<tiddler [[2019.08.28 - Blog :' Egregious 11 Meta-Analysis Part 2: Virtualizing Visibility']]>>=== 
* Blog : '''On-Chain vs Off-Chain governance. What are the rules to Calvinball?'''+++*[»]> <<tiddler [[2019.08.26 - Blog : 'On-Chain vs Off-Chain governance. What are the rules to Calvinball?']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.08.31 - Veille Hebdomadaire]] avec plus de 60 liens :
* __''À lire'' :__ "''Kubernetes #Fails''"+++*[»]>
|2019.08.27|DZone|![[Kubernetes #Fails|https://dzone.com/articles/kubernetes-fails]]|Kubernetes|
===, "''Scalable infrastructure for investigations and incident response''"+++*[»]>
|2019.08.30|//Microsoft//|![[Scalable infrastructure for investigations and incident response|https://msrc-blog.microsoft.com/2019/08/30/scalable-infrastructure-for-investigations-and-incident-response/]]|Incident_Handling Infrastructure|
=== et ''futur de la sécurité réseau dans le Cloud avec le SASE (//Secure Access Service Edge//) du Gartner''"+++*[»]>
|2019.08.30|//Gartner//|[[G00441737: The Future of Network Security Is in the Cloud|https://www.gartner.com/doc/reprints?id=1-6QW0Z4A&ct=190528]]|Gartner Network SASE G00441737|
=== 
* Piratages et fuites de données : fuite de données ''Imperva'' pour certains clients du "''Cloud WAF''" (ex ''Incapsula'')+++*[»]>
|2019.08.27|//Imperva//|[[Imperva Security Update|https://www.imperva.com/blog/ceoblog/]]|DataBreach Imperva|
|2019.08.27|Krebs on Security| → [[Cybersecurity Firm Imperva Discloses Breach|https://krebsonsecurity.com/2019/08/cybersecurity-firm-imperva-discloses-breach/]]|DataBreach Imperva|
=== 
* Pannes : Reddit suite à une panne AWS
* Vulnérabilités : ''Kubernetes'' avec un retour sur la CVE-2019-11245+++*[»]>
|2019.08.28|//Twistlock//|[[Non-root containers, Kubernetes CVE-2019-11245 and why you should care|https://www.twistlock.com/labs-blog/non-root-containers-kubernetes-cve-2019-11245-care/]]|Kubernetes CVE-2019-11245|
=== et un PoC de Spoofing DNS+++*[»]>
|2019.08.29|//Aqua//|![[DNS Spoofing on Kubernetes Clusters|https://blog.aquasec.com/dns-spoofing-kubernetes-clusters]]|Kubernetes DNS_Spoofing|
=== 
* Formation : promotion temporaire pour une offre commerciale de formation Azure tierce et __non certifiante__+++*[»]>
|>|>|>|!@@color:#f00;font-size:125%;<html><i class="fa fa-exclamation-triangle" aria-hidden="true"></i></html> — Ce lien vers une offre COMMERCIALE et PROMOTIONNELLE est fourni à titre INFORMATIF et n'est pas sponsorisé. 
<html><i class="fa fa-exclamation-triangle" aria-hidden="true"></i></html> — La formation NON CERTIFIANTE, N'a PAS été suivie, et n'est NI conseillée, NI recommandée, NI validée par les auteurs de cet article.
<html><i class="fa fa-exclamation-triangle" aria-hidden="true"></i></html> — Ces derniers se DÉGAGENT de TOUTE RESPONSABILITÉ quant à VOTRE décision de suivre le lien et à ses conséquences.@@| |2019.08.29|//TheNextWeb//|[[This Microsoft Azure training will take your from zero to in-demand data hero|https://thenextweb.com/offers/2019/08/29/this-microsoft-azure-training-will-take-your-from-zero-to-in-demand-data-hero/]]|Training Azure| === * Divers : impact(s) potentiel(s) lié(s) au (potentiel) ''Brexit''+++*[»]> |2019.08.30|BetaNews|[[GDPR and Brexit - Is your cloud provider ready for the UK 'being treated like a third country'?|https://betanews.com/2019/08/30/gdpr-and-brexit/]]|GDPR Brexit| === !3 - Contacts Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Août|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.08.31|
|2019.08.31|Bleeping Computer|[[Reddit Experiencing Outage Due to Amazon AWS Issue|https://www.bleepingcomputer.com/news/technology/reddit-experiencing-outage-due-to-amazon-aws-issue/]]|Outage AWS Reddit|
|>|>|>|!2019.08.30|
|2019.08.30|MISC[>img[iCSF/flag_fr.png]]|[[Gros plan sur la sécurité des environnements cloud Amazon Web Services|https://www.miscmag.com/gros-plan-sur-la-securite-des-environnements-cloud-amazon-web-services/]]|AWS|
|2019.08.30|BetaNews|[[GDPR and Brexit - Is your cloud provider ready for the UK 'being treated like a third country'?|https://betanews.com/2019/08/30/gdpr-and-brexit/]]|GDPR Brexit|
|2019.08.30|DZone|[[Survey Reveals Rapid Growth in Kubernetes Usage, Security Still a Concern|https://dzone.com/articles/survey-reveals-rapid-growth-in-kubernetes-usage-se]]|Kubernetes Report|
|2019.08.30|Infosec Island|[[Three Strategies to Avoid Becoming the Next Capital One|http://www.infosecisland.com/blogview/25219-Three-Strategies-to-Avoid-Becoming-the-Next-Capital-One.html]]|Incident CapitalOne Lessons_Learnt|
|2019.08.30|TechRepublic|[[How the Cloud Security Alliance helps businesses identify and mitigate cybersecurity risks|https://www.techrepublic.com/article/how-the-cloud-security-alliance-helps-businesses-identify-and-mitigate-cybersecurity-risks/]]|CSA|
|2019.08.30|The Register|[[Microsoft's cloudy Windows Virtual Desktop: It fills a gap, but there are plenty of annoyances|https://www.theregister.co.uk/2019/08/30/microsofts_cloudy_windows_virtual_desktop_fills_a_gap_but_with_plenty_of_annoyances/]]|Virtual_Desktop|
|2019.08.30|Solutions Review|[[5 Cloud Security Mistakes That Could Ruin Your Business|https://solutionsreview.com/cloud-platforms/5-cloud-security-mistakes-that-could-ruin-your-business/]]|Mistakes|
|2019.08.30|Krebs on Security|[[Phishers are Angling for Your Cloud Providers|https://krebsonsecurity.com/2019/08/phishers-are-angling-for-your-cloud-providers/]]|Third_Party Phishing CSP|
|2019.08.30|Verdict|[[Teletext Holidays data breach exposes 212,000 customer call recordings|https://www.verdict.co.uk/teletext-holidays-data-breach-customer-call/]]|AWS Data_Leak|
|2019.09.02|The Register| → [[Teletext Holidays a) exists and b) left 200k customer call recordings exposed in S3 bucket|https://www.theregister.co.uk/2019/09/02/teletext_holidays_200k_call_recordings_s3_bucket/]]|AWS Data_Leak|
|2019.08.30|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Institutions financières : le moment est-il venu de confier la conformité au cloud ?|https://www.silicon.fr/avis-expert/institutions-financieres-le-moment-est-il-venu-confier-la-conformite-au-cloud]]|Compliance|
|2019.08.30|//Microsoft//|![[Scalable infrastructure for investigations and incident response|https://msrc-blog.microsoft.com/2019/08/30/scalable-infrastructure-for-investigations-and-incident-response/]]|Incident_Handling Infrastructure|
|2019.08.30|//Microsoft//| → [[Powershell Scripts to automatically deploy an image of a prebuilt VM to every region you require|https://github.com/microsoft/Scalable-Infrastructure-for-Investigation-and-Incident-Response]]|Incident_Handling Infrastructure|
|2019.08.30|//Google//|[[Kubernetes security audit: What GKE and Anthos users need to know|https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-security-audit-what-gke-and-anthos-users-need-to-know]]|Kubernetes Audit|
|2019.08.30|//Lacework//|[[Avoid Gaps in Native Cloud Security Tools With a Comprehensive Security Approach, Part 2|https://www.lacework.com/integrate-cloud-security-tools/]] (2/2)|Strategy|
|2019.08.30|//Gartner//|![[G00441737: The Future of Network Security Is in the Cloud|https://www.gartner.com/doc/reprints?id=1-6QW0Z4A&ct=190528]]|Gartner Network SASE G00441737|
|>|>|>|!2019.08.29|
|2019.08.29|GSA|[[GSA and DOD Award Defense Enterprise Office Solutions Cloud Contract|https://www.gsa.gov/about-us/newsroom/news-releases/gsa-and-dod-award-defense-enterprise-office-solutions-cloud-contract]]|DoD O365|
|2019.08.29|Silicon Angle| → [[DOD awards $7.6B Microsoft Office 365 cloud contract to General Dynamics and partners|https://siliconangle.com/2019/08/29/dod-awards-7-6b-office-365-contract-general-dynamics-partners/]]|DoD O365|
|2019.08.30|Breaking Defense| → [[DoD 'Office' Functions Move To Cloud In Multi-Billion-Dollar Contract|https://breakingdefense.com/2019/08/dod-office-functions-move-to-cloud-in-multi-billion-dollar-contract/]]|Misc|
|2019.08.29|Bleeping Computer|[[Starbucks Abandons Azure Site, Exposed Subdomain to Hijacking|https://www.bleepingcomputer.com/news/security/starbucks-abandons-azure-site-exposed-subdomain-to-hijacking/]]|Azure DNS Incident|
|2019.08.29|DZone|[[Kubernetes Evolution|https://dzone.com/articles/kubernetes-evolution]]|Kubernetes|
|2019.08.29|//AppSecCo//|[[Getting shell and data access in AWS by chaining vulnerabilities|https://blog.appsecco.com/getting-shell-and-data-access-in-aws-by-chaining-vulnerabilities-7630fa57c7ed]]|AWS Vulnerabilities|
|2019.08.29|//Idaptative//|[[Next-Gen Access and Zero Trust are the PB&J of Security|https://www.idaptive.com/blog/Next-Gen-Access-Zero-Trust-PBJ-Security/]]|Zero_Trust|
|2019.08.29|//Google//|[[Now in beta: Managed Service for Microsoft Active Directory (AD)|https://cloud.google.com/blog/products/identity-security/now-in-beta-managed-service-for-microsoft-active-directory-ad]]|GCP Active_Directory|
|2019.08.29|Dark Reading| → [[Google Cloud Releases Beta of Managed Service to Microsoft AD|https://www.darkreading.com/cloud/google-cloud-releases-beta-of-managed-service-to-microsoft-ad/d/d-id/1335687]]|GCP Active_Directory|
|2019.08.29|Compare The Cloud|[[Don't let the FUD cloud the cloud|https://www.comparethecloud.net/articles/dont-let-the-fud-cloud-the-cloud/]]|Misc|
|2019.08.29|//JumpCloud//|[[How to Create a Secure Cloud Identity|https://jumpcloud.com/blog/create-secure-cloud-identity/]]|IAM|
|2019.08.29|//TheNextWeb//|[[This Microsoft Azure training will take your from zero to in-demand data hero|https://thenextweb.com/offers/2019/08/29/this-microsoft-azure-training-will-take-your-from-zero-to-in-demand-data-hero/]]|Training Azure|
|2019.08.29|//Aqua//|![[DNS Spoofing on Kubernetes Clusters|https://blog.aquasec.com/dns-spoofing-kubernetes-clusters]]|Kubernetes DNS_Spoofing|
|2019.08.29|//Synetis//[>img[iCSF/flag_fr.png]]|![[SecNumCloud et ISO / IEC 27001 : Quelle norme pour la sécurité du Cloud ?|https://www.synetis.com/secnumcloud-et-iso-iec-27001-quelle-norme-pour-la-securite-du-cloud/]]|Standards SecNumCloud ISO27001|
|>|>|>|!2019.08.28|
|2019.08.28|//DivvyCloud//|[[Financial Services Organizations Don't Need To Fear The Cloud|https://www.forbes.com/sites/forbestechcouncil/2019/08/28/financial-services-organizations-dont-need-to-fear-the-cloud/]]|Misc|
|2019.08.28|DZone|[[Kubernetes Concerns|https://dzone.com/articles/kubernetes-concerns]]|Kubernetes|
|2019.08.28|DZone|[[The Top Ten Cloud Tools From AWS|https://dzone.com/articles/top-10-aws-services]]|AWS|
|2019.08.28|DataCenter Mag|[[Transformation digitale : le SD-WAN peut-il aider à renforcer la sécurité des applications cloud-firs|https://datacenter-magazine.fr/transformation-digitale-le-sd-wan-peut-il-aider-a-renforcer-la-securite-des-applications-cloud-firs/]]|SDWAN|
|2019.08.28|Bloomberg|[[Cloud Security Boom Creates New Crop of Tech Darlings|https://www.bloomberg.com/news/articles/2019-08-28/young-guns-of-cybersecurity-emerge-as-winners-in-shift-to-cloud]]|Misc|
|2019.08.28|TechRepublic|[[How to use Harbor to scan Docker images for vulnerabilities|https://www.techrepublic.com/article/how-to-use-harbor-to-scan-docker-images-for-vulnerabilities/]]|Docker Prevention|
|2019.08.28|Security Boulevard|[[Hybrid vs. Cloud-Based Web Security: Anatomy of a Breach|https://securityboulevard.com/2019/08/hybrid-vs-cloud-based-web-security-anatomy-of-a-breach/]]|Breach|
|2019.08.28|//SecurityIntelligence//|[[Considering Container Security? 6 Ways to Make a Case for Containerization|https://securityintelligence.com/articles/considering-container-security-6-ways-to-make-a-case-for-containerization/]]|Containers|
|2019.08.28|//JumpCloud//|[[Can I Move Active Directory to the Cloud?|https://jumpcloud.com/blog/ad-to-the-cloud/]]|Active_Directory|
|2019.08.28|//Zscaler//|[[To flip the security model, start with "yes"|https://www.zscaler.com/blogs/corporate/flip-security-model-start-yes]]|Misc|
|2019.08.28|//Twistlock//|[[Non-root containers, Kubernetes CVE-2019-11245 and why you should care|https://www.twistlock.com/labs-blog/non-root-containers-kubernetes-cve-2019-11245-care/]]|Kubernetes CVE-2019-11245|
|2019.08.28|//AWS//|[[Summary of the Amazon EC2 and Amazon EBS Service Event in the Tokyo (AP-NORTHEAST-1) Region|https://aws.amazon.com/message/56489/]]|Outage AWS|
|>|>|>|!2019.08.27|
|2019.08.27|Wall Street Jounal|[[Human Error Often the Culprit in Cloud Data Breaches|https://www.wsj.com/articles/human-error-often-the-culprit-in-cloud-data-breaches-11566898203]]|Risks|
|2019.08.27|DZone|[[The IAM Conundrum |https://dzone.com/articles/the-iam-conundrum-1]]|IAM AWS|
|2019.08.27|DZone|![[Kubernetes #Fails|https://dzone.com/articles/kubernetes-fails]]|Kubernetes|
|2019.08.27|Times of Israël[>img[iCSF/flag_fr.png]]|[[Israël lance un appel d'offre pour un énorme centre de données en cloud|https://fr.timesofisrael.com/israel-lance-un-appel-doffre-pour-un-enorme-centre-de-donnees-en-cloud/]]|
|2019.08.27|//FireEye//|[[Automated Threat Remediation for Office 365 Is Now a Few Clicks Away (Part Two)|https://www.fireeye.com/blog/products-and-services/2019/08/automated-threat-remediation-for-office-365-is-now-a-few-clicks-away-part-two.html]] (2/2)|O365 Remediation|
|2019.08.27|Solutions Review|[[6 Devastating Cloud Migration Mistakes You Need to Avoid|https://solutionsreview.com/cloud-platforms/6-devastating-cloud-migration-mistakes-you-need-to-avoid/]]|Migration|
|2019.08.27|JDSupra|[[Alert: Treasury Department Issues Proposed Rules on Cloud Transactions, Other Digital Content|https://www.jdsupra.com/legalnews/alert-treasury-department-issues-76043/]]|Regulations|
|2019.08.27|//eXemplify//|[[Data in the Cloud: How a Valuable Tool Can Also Be a Risk|http://www.exemplifygroup.com/data-in-the-cloud-how-a-valuable-tool-can-also-be-a-risk/]]|Risks|
|2019.08.27|//Tripwire//|[[Who Is Responsible for Your Cloud Security?|https://www.tripwire.com/state-of-security/security-data-protection/cloud/responsible-cloud-security/]]|Responsibility|
|2019.08.27|Forbes|[[The Cloud Is Now For Mission-Critical Enterprise Systems|https://www.forbes.com/sites/forbestechcouncil/2019/08/27/the-cloud-is-now-for-mission-critical-enterprise-systems/]]|Reliability|
|2019.08.27|//Imperva//|[[Imperva Security Update|https://www.imperva.com/blog/ceoblog/]]|DataBreach Imperva|
|2019.08.27|Krebs on Security| → [[Cybersecurity Firm Imperva Discloses Breach|https://krebsonsecurity.com/2019/08/cybersecurity-firm-imperva-discloses-breach/]]|DataBreach Imperva|
|2019.08.27|Silicon Angle| → [[Imperva 'security incident' exposes customer data|https://siliconangle.com/2019/08/27/imperva-security-incident-exposes-cloud-waf-customer-data/]]|DataBreach Imperva|
|2019.08.27|Security Week| → [[Imperva Notifies Cloud WAF Customers of Security Incident|https://www.securityweek.com/imperva-notifies-cloud-waf-customers-security-incident]]|DataBreach Imperva|
|2019.08.27|//Threatpost//| → [[Imperva Firewall Breach Exposes Customer API Keys, SSL Certificates|https://threatpost.com/imperva-firewall-breach-api-keys-ssl-certificates/147743/]]|DataBreach Imperva|
|2019.08.27|CBR Online| → [[Imperva Hacked: Customer API Keys, SSL Certificates Stolen|https://www.cbronline.com/news/imperva-hacked]]|DataBreach Imperva|
|2019.08.27|//Lacework//|[[Avoid Gaps in Native Cloud Security Tools With a Comprehensive Security Approach, Part 1|https://www.lacework.com/native-cloud-security-gaps/]] (1/2)|Strategy|
|2019.08.27|//Azure//|[[Latency is the new currency of the Cloud: Announcing 31 new Azure edge sites|https://azure.microsoft.com/en-us/blog/latency-is-the-new-currency-of-the-cloud-announcing-31-new-azure-edge-sites/]]|Latency|
|2019.08.27|//Fortinet//|[[Securing Your Dynamic Cloud Strategy|https://www.fortinet.com/blog/industry-trends/secure-your-dynamic-cloud-strategy.html]]|Misc|
|2019.08.27|NextCloud|[[Amid escalating trade disputes, EU governments choose independence from US cloud providers|https://nextcloud.com/press/pr20190827/]]|NextCloud|
|2019.08.29|ZDnet[>img[iCSF/flag_fr.png]]| → [[Nextcloud : le ministère de l'Intérieur opte pour une solution libre|https://www.zdnet.fr/actualites/nextcloud-le-ministere-de-l-interieur-opte-pour-une-solution-libre-39889691.htm]]|NextCloud|
|>|>|>|!2019.08.26|
|2019.08.26|Journal du Net[>img[iCSF/flag_fr.png]]|[[Gouvernance des données dans le cloud : comment l'aborder|https://www.journaldunet.com/solutions/expert/71621/gouvernance-des-donnees-dans-le-cloud---comment-l-aborder.shtml]]|Governance|
|2019.08.26|CIO Dive|![[Gartner: A 10-step cookbook for building a cloud strategy|https://www.ciodive.com/news/gartner-a-10-step-cookbook-for-building-a-cloud-strategy/561315/]]|Strategy|
|2019.08.26|BetaNews|[[How cloud-based training can help address the cybersecurity skills gap [Q&A]|https://betanews.com/2019/08/26/cloud-training-security-qa/]]|Training|
|2019.08.26|DZone|[[How to Implement Kubernetes|https://dzone.com/articles/keys-to-implementing-kubernetes]]|Kubernetes|
|2019.08.26|Compliant Cloud|![[Periodic Review for outsourced cloud-based computerised systems, applications and infrastructure|https://compliantcloud.com/periodic-review-for-outsourced-cloud-based-computerised-systems-applications-and-infrastructure/]]|Compliance|
|2019.08.26|//Alibaba//|[[Container Security: A Look at Rootless Containers|https://medium.com/datadriveninvestor/container-security-a-look-at-rootless-containers-7c2ea6f6842]]|Containers|
|2019.08.26|//Google//|[[5 steps to improve your cloud security posture with Cloud Security Command Center|https://cloud.google.com/blog/products/identity-security/5-steps-to-improve-your-cloud-security-posture-with-cloud-security-command-center]] (1/6)|Security_Posture|
|2019.08.26|//Bitglass//|[[The Four Pillars of CASB: Data Protection|https://www.bitglass.com/blog/four-pillars-casb-data-protection]] (1/4)|CASB|
|2019.08.26|//Deloitte//|[[Data modernization and the cloud|https://www2.deloitte.com/us/en/insights/topics/analytics/data-modernization-and-cloud-migration-initiatives.html]]|Report Deloitte|
|2019.08.31|ZDnet| → [[Cloud needs a modern data foundation, modern data needs a cloud foundation|https://www.zdnet.com/article/cloud-needs-a-modern-data-foundation-modern-data-needs-a-cloud-foundation/]]|Report Deloitte|
|2019.09.03|ZDnet[>img[iCSF/flag_fr.png]]| → [[Analyse : le cloud a besoin d'une base de données moderne, et les données modernes ont besoin du cloud|https://www.zdnet.fr/actualites/analyse-le-cloud-a-besoin-d-une-base-de-donnees-moderne-et-les-donnees-modernes-ont-besoin-du-cloud-39889899.htm]]|Report Deloitte|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Août 2019]]>>
!"//Egregious 11 Meta-Analysis Part 2: Virtualizing Visibility//"
[>img(200px,auto)[iCSA/J9SBE.jpg]]Deuxième article de la série, publié le 28 août 2019 — Rédigé par Victor Chin, Research Analyst, CSA
<<<
//This is the second blog post in the series where we analyze the security issues in the new iteration of the Top Threats to Cloud Computing report. Each blog post features a security issue that is being perceived as less relevant and one that is being perceived as more relevant.

In this report, we found that traditional cloud security issues stemming from concerns about having a third-party provider are being perceived as less relevant. While more nuanced issues specific to cloud environments are being perceived as more problematic. With this in mind, we will be examining Shared Technology Vulnerabilities and Limited Cloud Usage Visibility further.
Please note that the Top Threats to Cloud Computing reports are not meant to be the definitive list of security issues in the cloud. Rather, the studies measures what industry experts perceive the key security issues to be.

__Shared Technology Vulnerabilities__
Shared Technology Vulnerabilities generally refers to vulnerabilities in the virtual infrastructure where resources are shared amongst tenants. Over the years, there have been several vulnerabilities of that nature with the most prominent being the VENOM (CVE-2015-3456)~~[1]~~ vulnerability that was disclosed in 2015. Shared Technology Vulnerabilities used to be high up on the list of problematic issues. For example, in the first two iterations of the report, Shared Technology Vulnerabilities were rated at 9th and 12th. In the latest iteration of the report, it has dropped off entirely and is no longer perceived by as relevant. It had a score of 6.27 (our cutoff was 7 and above) and ranked 16 out of the 20 security issues surveyed.

Virtualization itself is not a new cloud technology, and its benefits are well known. Organizations have been using virtualization technology for many years as it helps to increase organizational IT agility, flexibility, and scalability while generating cost savings. For example, organizations would only have to procure and maintain one physical asset. That physical IT asset is then virtualized so that its resources are shared across the organization. As the organization owns and manages the entire IT stack, it also has visibility and control over the virtualization technology.

In cloud environments, the situation is markedly different. Virtualization technology (like hypervisors) is generally considered underlying technology that is owned and managed by the cloud service provider. Consequently, the cloud customer has limited access or visibility into the virtualization layer.

[>img(400px,auto)[iCSA/J9SBE.png]]For example, the figure on the right is an architectural representation of the three cloud service models. Underlying technology in an Infrastructure-as-a-Service (IaaS) service model refers to APIs (blue) and anything else below it. Those components are under the control and management of the CSP. At the same time, anything above the APIs (blue) is under the control and management of the cloud customer. For Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS), underlying technology refers to anything underneath Integration & Middleware and Presentation Modality and Presentation Platform, respectively.

Naturally, in the early days of cloud computing, such vulnerabilities were a significant concern for customers. Not only did they have limited access and visibility into the virtualization layer, but the cloud services were also all multi-tenant systems which contained the data and services of other customers of the CSPs.

Over time, it seems like the industry has grown to trust the cloud service providers when it comes to Shared Technology Vulnerabilities. Cloud adoption is at its highest with many organizations adopting a 'Cloud First' policy. However, there is still no industry standard or existing framework that formalizes vulnerability notifications for CSPs, even when a vulnerability is found in the underlying cloud infrastructure. For example, when there is a vulnerability disclosure for a particular hypervisor, (e.g. XEN) an affected CSP does not have to provide any information to its customers. For more information on this issue, please read my other blogpost on cloud vulnerabilities.

That said, it is of note that many recent cloud breaches are the result of misconfigurations by cloud customers. For example, in 2017, Accenture left at least four Amazon S3 buckets set to public and exposed mission-critical infrastructure data. As cloud services developed, the major CSPs have, for the most part, provided sufficient security controls to enable cloud customers to properly configure their environments.

Nevertheless, virtualization technology is a critical component to any cloud service, and vulnerabilities in the virtualization layer can have severe consequences. Cloud customers must remain vigilant when it comes to Shared Technology Vulnerabilities.

__Limited Cloud Usage Visibility__
In the latest Top Threats to Cloud Computing report, Limited Cloud Usage Visibility made its debut in the 10th position.

Limited Cloud Usage Visibility refers to when organizations experience a significant reduction in visibility over their information technology stack. This is due to two main factors. Firstly, unlike in traditional IT environments, the enterprise does not own or manage the underlying cloud IT infrastructure. Consequently, they are not able to fully implement security controls or monitoring tools with as much depth and autonomy as they did with a traditional IT stack. Instead, cloud customers often have to rely on logs provided to them by the cloud providers. Sometimes, these logs are not as detailed as the customer would like it to be.

Secondly, cloud services are highly accessible. They can generally be accessed from the public internet and do not have to go through a company VPN or gateway. Hence, the effectiveness of some traditional enterprise security tools is reduced. For instance, network traffic monitoring and perimeter firewalls are not as effective as they cannot capture network traffic to cloud services that originate outside the organization. For many organizations, such monitoring capabilities are becoming more critical as they begin to host business-critical data and services in the cloud.

To alleviate the issue, enterprises can start using more cloud-aware technology or services to provide more visibility and control of the cloud environment. However, most of the time, the level of control and granularity cannot match that of a traditional IT environment. This lack of visibility and control is something that enterprises moving to the cloud have to get used to. There will be some level of risk associated to it, and it is a risk that they have to accept or work around. Organizations that are not prepared for this lack of visibility in the cloud might end up not applying the proper mitigations. That or they will find themselves unable to fully realize the cost savings of a cloud migration.
[...]
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456 //
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/13/egregious-11-meta-analysis-part-1-insufficient-due-diligence-and-cloud-security-architecture-and-strategy/]] sur le blog de la CSA.
!"//On-Chain vs Off-Chain governance. What are the rules to Calvinball?//"
[>img(150px,auto)[iCSA/J8QBO.png]]Article de blog publié le 26 août 2019 — Rédigé par Kurt Seifried, Chief Blockchain Officer, CSA
<<<
//If you don't know what Calvin and Hobbes is you can skip the next bit, but it is amusing.

Calvinball is a game invented by Calvin and Hobbes. Calvinball has no rules; the players make up their own rules as they go along, making it so that no Calvinball game is like another.Rules cannot be used twice (except for the rule that rules cannot be used twice), and any plays made in one game may not be made again in any future games. The game may involve wickets, mallets, volleyballs, and additional sports-related equipment.

If you are familiar with Blockchain governance then the rules to Calvinball may sound eerily similar.

Anytime we build a complex system it will need to be governed by rules. This is especially true for any complex system that involves humans and may need to be modified in the future. In effect, you will not only need rules to govern the system, but rules to govern the rules governing the system. Do you require a 51% majority vote to make a change? How many voters have to participate for a decision to be valid? What defines a voter? What defines a vote? How long are votes held for, how are they announced, who is allowed to initiate a vote?

This was the part where I started discussing on-chain vs. off-chain governance models and various technical aspects of them. But I realized it doesn't matter that much, ultimately what it boils down to is a few core questions:
* Where are the rules defined?
* How are the rules changed?
* Who enforces the current rules?
* How do you create consensus?
* How do you handle disagreements?
* How do you build the incentives to support the above?

Whether or not this happens on chain or off chain we have one ultimate question: How do you build the incentives to support the above? Do you give the miners power? The holders of the tokens? The governance board for the Blockchain?

In general when it comes to building consensus and handling disagreements the least worst solution we have found is democracy, people vote, feel heard, and hopefully both the winners and the losers accept the results and continue on with their lives. When people refuse to accept the results we have problems, for example a Blockchain with a significant and passionate group that is opposed to a change may hard fork, effectively taking their ball and going elsewhere with it. Alternatively I have seen Blockchains attempt to create safety valves, for example allowing people who disagree with a change to close out their position and exit the market in an orderly manner, minimizing the chances of a hard fork.

Because ultimately Blockchain and any complex system that relies upon network effects to create value must foster and encourage consensus between the participants or else it risks pushing people away, and it's not like there aren't hundreds of other Blockchain projects people can //
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/26/on-chain-vs-off-chain-governance-what-are-the-rules-to-calvinball/]] sur le blog de la CSA.
!1 - Les nouveautés CSA de la semaine du 19 au 25 août 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Actu: Appel à commentaires, document ''Software-Defined Perimeter as a DDoS Prevention Mechanism''+++*[»]> <<tiddler [[2019.08.19 - Actu : Appel à commentaires, document 'Software-Defined Perimeter as a DDoS Prevention Mechanism']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.08.25 - Veille Hebdomadaire]] avec plus de 90 liens :
* Alertes: plusieurs vulnérabilités Kubernetes+++*[»]> <<tiddler [[2019.08.31.Alert]]>>=== 
* Piratages et fuites de données : encore plusieurs commentaires suites de l'attaques contre Capital One dont la Banque Centrale Européenne (''BCE'')et Patrice Bernard
* Rapports et sondages : ''(ISC)^^2^^'', ''Kaspersky'', ''Outpost24'', ''Report Ocean'', ''Tripwire'', ''Vade Secure''
* Attaques : encore du phishing utilisant des ressources dans le Cloud
* Panne : Claranet (UK), GitHub, Google
* Divers : création de la communauté ''Confidential Computing Consortium'' par la Linux Foundation
!3 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Août|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!Vulnérabilités Kubernetes|
|2019.08.13|Netflix|[[NFLX-2019-002: HTTP/2 Denial of Service Advisory|https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md]]|Kubernetes CVE-2019-9511→9518|
|2019.08.23|Security Week| → [[Kubernetes Patches Recent HTTP/2 Vulnerabilities|https://www.securityweek.com/kubernetes-patches-recent-http2-vulnerabilities]]|Kubernetes Vulnerabilities|
|2019.08.23|Packt pub| → [[A security issue in the net/http library of the Go language affects all versions and all components of Kubernetes|https://hub.packtpub.com/a-security-issue-in-the-net-http-library-of-the-go-language-affects-all-versions-and-all-components-of-kubernetes/]]|Kubernetes Vulnerabilities|
|2019.08.22|//PaloAlto Networks//| → [[Kubernetes - Vulnerable to Denial-of-Service Attacks|https://blog.paloaltonetworks.com/2019/08/cloud-kubernetes-vulnerable-denial-service-attacks/]]|Kubernetes Vulnerabilities|
|2019.08.20|Bleeping Computer| → [[Severe Flaws in Kubernetes Expose All Servers to DoS Attacks|https://www.bleepingcomputer.com/news/security/severe-flaws-in-kubernetes-expose-all-servers-to-dos-attacks/]]|Kubernetes Vulnerabilities|
|>|>|>|!Incident CapitalOne|
|2019.08.24|Fortune| → [[Even After Capital One's Breach, Don't Doubt the Cloud - Cyber Saturday|https://fortune.com/2019/08/24/even-after-capital-ones-breach-dont-doubt-the-cloud-cyber-saturday/]]|Risks|
|2019.08.23|Dark Reading|! → [[Capital One Breach: What Security Teams Can Do Now|https://www.darkreading.com/endpoint/capital-one-breach-what-security-teams-can-do-now/a/d-id/1335475]]|Incident CapitalOne AWS MITRE_ATT&CK Lessons_Learnt|
|2019.08.19|//CloudPassage//| → [[Preventing a Capital One Cloud Data Breach|https://blog.cloudpassage.com/2019/08/21/preventing-a-capital-one-cloud-data-breach/]]|Incident CapitalOne Lessons_Learnt|
|2019.08.20|CIO Dive| → [[Onus for cloud security falls on customers, but AWS could do more, CISO says|https://www.ciodive.com/news/onus-for-cloud-security-falls-on-customers-but-aws-could-do-more-ciso-say/561269/]]|Incident CapitalOne AWS|
|2019.08.19|Banque Centrale Européenne|![[ECB Says the Next European Bank Hack Is Just a Matter of Time|https://www.bloomberg.com/news/articles/2019-08-19/ecb-says-the-next-european-bank-hack-is-just-a-matter-of-time]]|Threats CapitalOne|
|2019.08.19|Patrice Bernard|! → [[Et le cloud devint bouc émissaire|http://cestpasmonidee.blogspot.com/2019/08/et-le-cloud-devint-bouc-emissaire.html]]|CapitalOne Lessons_Learnt|
|2019.08.19|Security Week| → [[AWS: No Significant Issues at Other Alleged Targets of Capital One Hacker|https://www.securityweek.com/aws-no-significant-issues-other-alleged-targets-capital-one-hacker]]|Incident CapitalOne AWS|
|2019.08.19|//Duo Security//| → [[AWS Promises to Scan for Misconfigured Servers|https://duo.com/decipher/aws-promises-to-scan-for-misconfigured-servers]]|Incident CapitalOne AWS|
|>|>|>|!2019.08.25|
|2019.08.25|//Infoblox//|[[Cloud and IPv6|https://community.infoblox.com/t5/IPv6-CoE-Blog/Cloud-and-IPv6/ba-p/3510]]|IPv6|
|>|>|>|!2019.08.24|
|2019.08.24|Secure Reading|[[Securing Cloud Data: Role of Encryption in the Cloud|https://securereading.com/securing-cloud-data-role-of-encryption-in-the-cloud/]]|Encryption|
|>|>|>|!2019.08.23|
|2019.08.23|Le Big Data[>img[iCSF/flag_fr.png]]|[[Cloud : quelles sont les principales menaces et comment s'en protéger|https://www.lebigdata.fr/cloud-menaces]]|CSA Threats|
|2019.08.23|Computer Weekly|[[Majority of organisations struggling with cloud security|https://www.computerweekly.com/news/252469101/Majority-of-organisations-struggling-with-cloud-security]]|Misc|
|2019.08.23|VMblog|[[Who Guards Cloud: Major Cloud Computing Risks and How to Protect It|https://vmblog.com/archive/2019/08/23/who-guards-cloud-major-cloud-computing-risks-and-how-to-protect-it.aspx]]|Risks|
|2019.08.23|The Next Web|[[AWS issues are causing erratic cryptocurrency market data in Asia|https://thenextweb.com/hardfork/2019/08/23/aws-issues-are-causing-erratic-cryptocurrency-market-data-in-asia/]]|Outage AWS Impacts|
|2019.08.23|//Lacework//|[[Lacework Resolves the Container Security Gap|https://www.lacework.com/lacework-container-security/]]|Containers|
|2019.08.23|//Microsoft//|[[Azure AD Mailbag: Tips for Azure AD reporting and monitoring your day-to-day activities |https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Azure-AD-Mailbag-Tips-for-Azure-AD-reporting-and-monitoring-your/ba-p/566498]]|AzureAD Monitoring|
|2019.08.23|//IBM//|[[Quantum Security|https://www.ibm.com/thought-leadership/institute-business-value/report/quantumsecurity]]|Quantum_Computing|
|2019.08.23|Gigabit| → [[Will quantum computing revolutionise cybersecurity? IBM thinks so |https://www.gigabitmagazine.com/cloud-computing/will-quantum-computing-revolutionise-cybersecurity-ibm-thinks-so]]|Quantum_Computing|
|2019.08.23|Dark Reading| → [[IBM Announces Quantum Safe Encryption|https://www.darkreading.com/application-security/ibm-announces-quantum-safe-encryption/d/d-id/1335632]]|Quantum_Computing|
|2019.08.23|//OCD-Tech//|[[Vulnerabilities in the Cloud: Whose Responsibility is it Anyways?|https://ocd-tech.com/2018/08/23/vulnerabilities-in-the-cloud-whose-responsibility-is-it-anyways/]]|Vulnerabilities Responsibility|
|2019.08.23|//Cloudonaut//|[[Complete AWS IAM Reference|https://iam.cloudonaut.io/]]|AWS IAM|
|>|>|>|!2019.08.22|
|2019.08.22|Infosec Institute|[[AWS Security Monitoring Checklist|https://resources.infosecinstitute.com/aws-security-monitoring-checklist/]]|AWS Monitoring|
|2019.08.22|Bleeping Computer|[[GitHub Experienced Widespread Major Services Outage|https://www.bleepingcomputer.com/news/technology/github-experienced-widespread-major-services-outage/]]|Outage GitHub|
|2019.08.22|Computer Weekly|[[Cyber attackers exploiting poor cloud security|https://www.computerweekly.com/news/252469000/Cyber-attackers-exploiting-poor-cloud-security]]|Threats|
|2019.08.22|Container Journal|[[Do VPNs Have a Place in Container Security?|https://containerjournal.com/topics/container-security/do-vpns-have-a-place-in-container-security/]]|Containers VPN|
|2019.08.22|Healthcare IT News|[[CISO security tips for managing hybrid cloud deployments|https://www.healthcareitnews.com/news/ciso-security-tips-managing-hybrid-cloud-deployments]]|Hybrid_Cloud|
|2019.08.22|infoRisk Today|[[Cloud Security: Mess It Up and It's on You|https://www.inforisktoday.com/cloud-security-mess-up-its-on-you-a-12942]]|Governance|
|2019.08.22|DZone|[[Serverless on GCP: A Comprehensive Guide|https://dzone.com/articles/serverless-on-gcp]]|GCP Serverless|
|2019.08.22|Techtarget|[[Use modern cloud security best practices|https://searchcloudcomputing.techtarget.com/tip/Use-modern-cloud-security-best-practices]]|Best_Practices|
|2019.08.22|//Aqua//[>img[iCSF/flag_fr.png]]|[[la sécurité doit être intégrée dès la phase de conception des architectures|http://www.globalsecuritymag.fr/Rani-Osnat-Aquasec-la-securite,20190823,89916.html]]|Containers|
|2019.08.22|//Vade Secure//[>img[iCSF/flag_fr.png]]|[[Le phishing visant Facebook monte en flèche au 2e trimestre 2019, tandis que Microsoft demeure la marque la plus ciblée|http://www.globalsecuritymag.fr/Le-phishing-visant-Facebook-monte,20190822,90087.html]]|Report Vade_Secure|
|2019.08.22|//Tripwire//|![[Survey: 84% of Security Pros Said Their Organizations Struggled to Maintain Security Configurations in the Cloud|https://www.tripwire.com/state-of-security/security-data-protection/cloud/survey-84-of-security-pros-said-their-organizations-struggled-to-maintain-security-configurations-in-the-cloud/]]|Report SANS|
|2019.08.22|//Outpost24//|[[37% Of Organisations Have Suffered A Cyberattack On Cloud Environments Due To The Lack Of Basic Cloud Security Hygiene|https://www.informationsecuritybuzz.com/study-research/37-of-organisations-have-suffered-a-cyberattack-on-cloud-environments-due-to-the-lack-of-basic-cloud-security-hygiene/]]|Report Outpost24|
|2019.08.22|//Sonatype//|[[Building Microservice Architecture on Kubernetes|https://blog.sonatype.com/microservice-architecture-on-kubernetes]]|Kubernetes MicroServices|
|2019.08.22|//Akamai//|[[How to Provide Secure Access to AWS Workloads|https://blogs.akamai.com/2019/08/how-to-provide-secure-access-to-aws-workloads.html]]|Access_Controls|
|2019.08.22|//McAfee//|[[19 Cloud Security Best Practices for 2019|https://securingtomorrow.mcafee.com/business/cloud-security/top-19-cloud-security-best-practices/]]|Best_Practices|
|2019.08.22|//Google//|[[Got microservices? Service mesh management might not be enough|https://cloud.google.com/blog/products/api-management/got-microservices-service-mesh-management-might-not-be-enough]]|APIs|
|2019.08.22|//Caylent//|[[Securing Your Kubernetes Pipeline|https://caylent.com/securing-your-kubernetes-pipeline/]]|Kubernetes|
|2019.08.22|//eXemplify//|[[Infographic: The Cloud and IoT Working Together|http://www.exemplifygroup.com/cloud-iot-infographic/]]|IoT|
|>|>|>|!2019.08.21|
|2019.08.21|(ISC)2|![[2019 Cloud Security Report|https://www.isc2.org/resource-center/reports/cloud-security-report?utm_campaign=T-HQ-Cloud-Security-Report]]|Report ISC2|
|2019.08.21|Confidential Computing Consortium|![[New Cross-Industry Effort to Advance Computational Trust and Security for Next-Generation Cloud and Edge Computing|https://confidentialcomputing.io/2019/08/21/new-cross-industry-effort-to-advance-computational-trust-and-security-for-next-generation-cloud-and-edge-computing/]]|Trust_Initiative|
|2019.08.21|GeekWire| → [[Microsoft, Google, Red Hat and others join forces for cloud security in 'confidential computing' group|https://www.geekwire.com/2019/microsoft-google-red-hat-others-join-forces-cloud-security-confidential-computing-group/]]|Trust_Initiative|
|2019.08.21|Computer Weekly| → [[Tech firms join forces to boost cloud security|https://www.computerweekly.com/news/252469010/Tech-firms-join-forces-to-boost-cloud-security]]|Trust_Initiative|
|2019.08.23|HelpNet Security| → [[New cross-industry consortium aims to accelerate confidential computing adoption|https://www.helpnetsecurity.com/2019/08/23/accelerate-confidential-computing-adoption/]]|Trust_Initiative|
|2019.08.21|CIO Review|[[Knowing your Provider's Capabilities is Critical to Cloud Security|https://sdn.cioreview.com/cxoinsight/knowing-your-provider-s-capabilities-is-critical-to-cloud-security-nid-24427-cid-147.html]]|CSP|
|2019.08.21|The Register|[[Welcome to Hollywood, Claranet-style: You've (not) got mail, or hosted sites for that matter|https://www.theregister.co.uk/2019/08/21/claranet_celebrates_wednesday_with_a_good_old_fashioned_outage/]]|Outage Claranet|
|2019.08.21|MeriTalk|[[Special Report: Zero Trust Necessary for Cloud Security|https://www.meritalk.com/articles/special-report-zero-trust-necessary-for-cloud-security/]]|Zero_Trust|
|2019.08.21|MSSP Alert|[[AWS Cloud Security: Web Application Firewall Statement|https://www.msspalert.com/cybersecurity-breaches-and-attacks/aws-wap-statement/]]|AWS Prevention|
|2019.08.21|//HiveMQ//|[[IoT Security in the cloud - How to integrate IoT Device Authentication and Authorization with HiveMQ and AWS|https://www.hivemq.com/blog/iot-security-hivemq-ese-aurora/|]]|IoT AWS|
|2019.08.21|//Box//|[[Introducing intelligent, frictionless content security with Box Shield|https://blog.box.com/box-shield-intelligent-frictionless-content-security]]|Detection Box|
|2019.08.21|SiliconAngle| → [[Box adds stricter access controls and threat detection capabilities|https://siliconangle.com/2019/08/21/box-adds-stricter-access-controls-threat-detection-capabilities/]]|Detection Box|
|2019.08.21|Dark Reading| → [['Box Shield' Brings New Security Controls|https://www.darkreading.com/cloud/box-shield-brings-new-security-controls-/d/d-id/1335593]]|Detection Box|
|2019.08.21|//Radware//|[[How to Choose a Cloud DDoS Scrubbing Service|https://blog.radware.com/security/ddos/2019/08/how-to-choose-a-cloud-ddos-scrubbing-service/]]|DDoS|
|2019.08.21|//Lacework//|[[Developing a Security-First Model for Cloud Compliance|https://www.lacework.com/security-first-cloud-compliance/]]|Compliance|
|2019.08.21|//Keysight//[>img[iCSF/flag_fr.png]]|[[Quatre priorités pour sécuriser le cloud|https://www.informatiquenews.fr/quatre-priorites-pour-securiser-le-cloud-lora-ohaver-keysight-technologies-62987]]|Misc|
|2019.08.21|//Fugue//|[[Why You Need Automated Remediation for AWS Security Groups and VPCs|https://www.fugue.co/blog/why-you-need-automated-remediation-for-aws-security-groups-and-vpcs]]|Remediation AWS|
|2019.08.21|//JumpCloud//|[[Google Cloud Identity vs Active Directory|https://jumpcloud.com/blog/google-cloud-identity-vs-active-directory/]]|GCP ActiveDirectory|
|2019.08.21|//Black Hills//|![[Securing the Cloud: A Story of Research, Discovery, and Disclosure|https://www.blackhillsinfosec.com/securing-the-cloud-a-story-of-research-discovery-and-disclosure/]]|AWS EMR|
|>|>|>|!2019.08.20|
|2019.08.20|NCSC UK|[[Cloud security made easier with Serverless|https://www.ncsc.gov.uk/blog-post/cloud-security-made-easier-with-serverless]]|Serverless|
|2019.08.20|Solutions Review|[[6 Questions to Ask Before Choosing a Cloud Managed Service Provider|https://solutionsreview.com/cloud-platforms/6-questions-to-ask-before-choosing-a-cloud-managed-service-provider/]]|Cloud_Managed_Service_Provider|
|2019.08.20|DZone|[[Cloud-Native Best Business Practices (Part 4): Automatic Backup and Disaster Recovery|https://dzone.com/articles/cloud-native-best-business-practices-part-4-automa]] (4/7)|Best_Practices|
|2019.08.20|DevOps|[[Autonomous Security in Containers|https://devops.com/autonomous-security-in-containers/]]|Containers|
|2019.08.20|//HiveMQ//|[[MQTT Topics & Best Practices - MQTT Essentials: Part 5|https://www.hivemq.com/blog/mqtt-essentials-part-5-mqtt-topics-best-practices/]] (5/5)|MQTT|
|2019.08.20|//Threatpost//|[[How to Prepare for Misconfigurations Clouding the Corporate Skies|https://threatpost.com/how-to-prepare-for-misconfigurations-that-cloud-the-corporate-skies/147538/]]|Misconfigurations|
|2019.08.20|//Managed Methods//|[[Use this 7 step data loss prevention checklist to help plan and tackle your DLP strategy|https://managedmethods.com/blog/data-loss-prevention-checklist/]]|DLP|
|2019.08.20|//Aryaka//|[[Building and Maintaining an SD-WAN is Complex and Time Consuming - Aryaka's Third Annual Global State of the WAN Report Reveals New Insights|https://vmblog.com/archive/2019/08/20/building-and-maintaining-an-sd-wan-is-complex-and-time-consuming-aryaka-s-third-annual-global-state-of-the-wan-report-reveals-new-insights.aspx]] ([[rapport|https://info.aryaka.com/state-of-the-wan-report-2019.html]]|Report Aryaka|
|2019.08.20|//Zscaler//|[[Four security hurdles with SD-WAN (and how to avoid them)|https://www.zscaler.com/blogs/corporate/four-security-hurdles-sd-wan-and-how-avoid-them]]|SD-WAN|
|2019.08.20|//Immuniweb//[>img[iCSF/flag_fr.png]]|[[Étude : L'état de la sécurité des applications parmi les 100 premières start-up mondiales fintech|http://www.globalsecuritymag.fr/Etude-L-etat-de-la-securite-des,20190820,89999.html]]|Report Immuniweb|
|2019.08.20|//Tripwire//|[[Forensics in the Cloud: What You Need to Know|https://www.tripwire.com/state-of-security/security-data-protection/cloud/forensics-cloud-need-to-know/]]|Forensics|
|2019.08.20|//Naked Security by Sophos//|[[Serious Security: Phishing in the cloud - the freemium way|https://nakedsecurity.sophos.com/2019/08/20/serious-security-phishing-in-the-cloud-the-freemium-way/]]|Phishing|
|2019.08.20|//Azure//|[[Azure Security Center single click remediation and Azure Firewall JIT support|https://azure.microsoft.com/en-us/blog/azure-security-center-single-click-remediation-and-azure-firewall-jit-support/]]|Azure|
|2019.08.20|//Microsoft //|[[One simple action you can take to prevent 99.9 percent of attacks on your accounts|https://www.microsoft.com/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/]]|Authentication MFA|
|2019.08.20|//Qualys//|[[If You Don't Have Visibility, You Don't Have Security|https://www.infosecisland.com/blogview/25217-If-You-Dont-Have-Visibility-You-Dont-Have-Security.html]]|Asset Management|
|2019.08.20|//CyberArk//[>img[iCSF/flag_fr.png]]|[[La chaine logistique, nouvelle cible des hackers|http://www.globalsecuritymag.fr/La-chaine-logistique-nouvelle,20190820,90013.html]]|Supply_Chain|
|2019.08.20|//Rapid7//|[[How Attackers Can Harvest Users' Microsoft 365 Credentials with New Phishing Campaign|https://blog.rapid7.com/2019/08/20/how-attackers-can-harvest-users-microsoft-365-credentials-with-new-phishing-campaign/]]|Phishing O365|
|2019.08.21|Bleeping Computer| → [[[Phishing Attacks Scrape Branded Microsoft 365 Login Pages|https://www.bleepingcomputer.com/news/security/phishing-attacks-scrape-branded-microsoft-365-login-pages/]]|Phishing O365|
|2019.08.20|//BlackBlaze//|[[What's the Diff: Private Cloud vs Public Cloud|https://www.backblaze.com/blog/private-cloud-vs-public-cloud/]]|Misc|
|2019.08.20|//CyberArk//|[[Four Things Security Can Do to Keep Up with DevOps CI/CD|https://www.cyberark.com/blog/four-things-security-can-do-to-keep-up-with-devops-ci-cd/]] (4/5)|SecDevOps|
|2019.08.20|//Thales//|[[The rise of hybrid cloud poses new security challenges - are you prepared?|https://blog.thalesesecurity.com/2019/08/20/the-rise-of-hybrid-cloud-poses-new-security-challenges-are-you-prepared/]]|Hybrid_Cloud|
|2019.08.20|//CCSI//|[[Secure SD-WAN Needs to Support Your Cloud On-Ramp Strategy|https://www.ccsinet.com/blog/secure-sdwan-cloud-strategy/]]|SD-WAN|
|2019.08.20|//FireEye//|[[Automated Threat Remediation for Office 365 Is Now a Few Clicks Away (Part One)|https://www.fireeye.com/blog/products-and-services/2019/08/automated-threat-remediation-for-office-365-a-few-clicks-away-part-one.html]] (1/2)|O365 Remediation|
|2019.08.20|//Veeam//[>img[iCSF/flag_fr.png]]|[[La sauvegarde fait plus que jamais partie intégrante de l'équation de la sécurité dans une ère de risques exceptionnels pour les entreprises|http://www.globalsecuritymag.fr/La-sauvegarde-fait-plus-que-jamais,20190819,89964.html]]|Backups|
|2019.08.20|//Veeam//[>img[iCSF/flag_fr.png]]|[[Les 6 principales raisons d'utiliser un service de sauvegarde dans le cloud (BaaS)|https://www.informatiquenews.fr/les-6-principales-raisons-dutiliser-un-service-de-sauvegarde-dans-le-cloud-baas-62962]]|Backups|
|2019.08.20|//Cyber Security Cloud//|[[Cyber Security Cloud Developed "Cyneural", A New Cyber Attack Detecting AI Engine Using Deep Learning|https://www.benzinga.com/pressreleases/19/08/n14303266/cyber-security-cloud-developed-cyneural-a-new-cyber-attack-detecting-ai-engine-using-deep-learning]]|Detection Deep_Learning|
|2019.08.20|//Clouonaut//|[[EC2 Instance Connect is an insecure default!|https://cloudonaut.io/ec2-instance-connect-is-an-insecure-default/]]|AWS Authentication|
|>|>|>|!2019.08.19|
|2019.08.19|Google|[[Google Cloud Console Incident #19008|https://status.cloud.google.com/incident/developers-console/19008]]|Outage Google|
|2019.08.19|Bleeping Computer| → [[Gmail Is Down, Displays "Something Went Wrong" Errors|https://www.bleepingcomputer.com/news/google/gmail-is-down-displays-something-went-wrong-errors/]]|Outage Google|
|2019.08.19|DZone|[[Kubernetes RBAC, Monitoring, Logging, Storage: What You Need to Know for Enterprise Use|https://dzone.com/articles/kubernetes-rbac-monitoring-logging-storage-what-yo]]|Kubernetes|
|2019.08.19|Compare The Cloud|[[Cloud Hosting vs Shared Hosting - The Pros and Cons|https://www.comparethecloud.net/articles/cloud-hosting-vs-shared-hosting-the-pros-and-cons/]]|Hosting|
|2019.08.19|JDSupra|[[Proposed Regulations on Cross-Border Cloud Transactions and other Digital Content Transactions|https://www.jdsupra.com/legalnews/proposed-regulations-on-cross-border-56056/]]|Regulations|
|2019.08.19|Dark Reading|[[Global Cyber Alliance Launches Cybersecurity Development Platform for Internet of Things (IoT) Devices|https://www.darkreading.com/risk/global-cyber-alliance-launches-cybersecurity-development-platform-for-internet-of-things-%28iot%29-devices/d/d-id/1335568]]|IoT|
|2019.08.19|isBuzz news|[[How To Overcome 3 Key Challenges Of Shared Responsibility In The Cloud|https://www.informationsecuritybuzz.com/articles/how-to-overcome-3-key-challenges-of-shared-responsibility-in-the-cloud-2/]]|Shared_Responsibility|
|2019.08.19|//HiveMQ//|[[Top 10 Criteria for Selecting a MQTT Broker|https://www.hivemq.com/blog/top-10-mqtt-broker-criteria/]]|MQTT|
|2019.08.19|//Lacework//|[[5 Limitations of Network-Centric Security in the Cloud|http://www.infosecisland.com/blogview/25216-5-Limitations-of-Network-Centric-Security-in-the-Cloud.html]]|Network_Security|
|2019.08.19|//Kaspersky//|[[IT threat evolution Q2 2019. Statistics|https://securelist.com/it-threat-evolution-q2-2019-statistics/92053/]]|
|2019.08.19|//JumpCloud//|[[Cloud OpenLDAP|https://jumpcloud.com/blog/cloud-openldap/]]|Authentication LDAP|
|2019.08.19|//Report Ocean//|[[Global Cloud Access Security Brokers Market Development, History, Current Industry Analysis and Estimated Forecast|https://scoopjunction.com/global-cloud-access-security-brokers-market-development-history-current-industry-analysis-and-estimated-forecast/36712/]]|Report CASB|
|2019.08.19|//Rapid7//|[[Automating the Cloud: AWS Security Done Efficiently|https://blog.rapid7.com/2019/08/19/automating-the-cloud-aws-security-done-efficiently/]]|AWS Automation|
|2019.08.19|//Aqua//|[[Trivy Vulnerability Scanner Joins the Aqua Family|https://blog.aquasec.com/trivy-vulnerability-scanner-joins-aqua-family]]|Containers Tools|
|2019.08.19|FedScoop|[[Why government is slow to endorse frameworks for quantifying cybersecurity risk|https://www.fedscoop.com/cybersecurity-risk-management-doe-dot/]]|Risk_Management FAIR|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Août 2019]]>>
[>img(100px,auto)[iCSA/CSAdoc.png]]Un appel à commentaires dont la date de clôture est le ''16 septembre 2019'' : "''Software-Defined Perimeter as a DDoS Prevention Mechanism''".
<<<
//The primary goal of this document is to increase the awareness and understanding of SDP as a tool to prevent DDoS attacks by demonstrating its efficiency and effectiveness against several well known attacks, including HTTP Flood, TCP SYN, and UDP Reflection.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j8jc/|https://cloudsecurityalliance.fr/go/j8jc/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!1 - Les nouveautés CSA de la semaine du 12 au 18 août 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Egregious 11 Meta-Analysis Part 1: (In)sufficient Due Diligence and Cloud Security Architecture and Strategy''+++*[»]> <<tiddler [[2019.08.13 - Blog : 'Egregious 11 Meta-Analysis Part 1: (In)sufficient Due Diligence and Cloud Security Architecture and Strategy']]>>=== 
* Publication : ''What is personal data under the GDPR?''+++*[»]> <<tiddler [[2019.08.14 - Publication : 'What is personal data under the GDPR?']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.08.18 - Veille Hebdomadaire]] avec plus de 60 liens :
* Piratages et fuites de données : toujours des commentaires sur l'incident chez ''Capital One''
* Rapports et sondages : ''CloudPassage'', ''Fortinet''
* Divers : recherche de composants mal configurés dans le Cloud, détection de dysfonctionnements, plan de réponse à un incident cloud ou lié à des containers, le programme ''Cloud Smart'' américain
!3 - Agenda
* Une première version du planning du congrès CSA de Berlin est disponible → [[CloudSecurityAlliance.fr/go/jBjE/|https://cloudsecurityalliance.fr/go/jBjE/]]
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Août|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.08.17|
|2019.08.17|Framboise314[>img[iCSF/flag_fr.png]]|[[Un cluster de Raspberry Pi avec Kubernetes|https://www.framboise314.fr/un-cluster-de-raspberry-pi-avec-kubernetes/]]|Kubernetes RaspberryPi|
|2019.08.17|ZDnet|[[Cloud security is too important to leave to cloud providers|https://www.zdnet.com/article/cloud-security-is-too-important-to-leave-to-cloud-providers/]]|CSA|
|>|>|>|!2019.08.16|
|2019.08.16|CBR Online|[[You Can Now Trigger a Kernel Panic on AWS EC2 Instances by API|https://www.cbronline.com/news/aws-kernel-panic-diagnostic-interrupt]]|AWS APIs Issue|
|2019.08.16|Security Boulevard|[[What Unique Cloud Document Indicators Can Reveal About Data Loss Risk|https://securityboulevard.com/2019/08/what-unique-cloud-document-indicators-can-reveal-about-data-loss-risk/]]|Data_Loss|
|2019.08.16|DISA|[[DISA streamlines approach to cloud authorizations|https://disa.mil/NewsandEvents/2019/cloud-authorizations]]|Authorization US|
|2019.08.16|NextGov| → [[It's Official: Defense Department Will Use Other Agencies' Cloud Security Assessments|https://www.nextgov.com/cybersecurity/2019/08/its-official-defense-department-will-use-other-agencies-cloud-security-assessments/159241/]]|Authorization US|
|2019.08.16|//Roger Halbheer//|[[How to leverage "Secure Access Workstations" for the Cloud|https://www.halbheer.ch/security/2019/08/16/how-to-leverage-secure-access-workstations-for-the-cloud/]]|Secure_Access|
|>|>|>|!2019.08.15|
|2019.08.15|CyberDefense Mag|[[What's the Matter with S3?|https://www.cyberdefensemagazine.com/whats-the-matter-with-s3/]]|S3|
|2019.08.15|NextGov|[[Accelerating Cloud Computing in Government Requires New Management Approach|https://www.nextgov.com/ideas/2019/08/accelerating-cloud-computing-government-requires-new-management-approach/159202/]]|Government|
|2019.08.15|Federal News Network|[[DHS letting its components, 'smart' strategy guide its own cloud journey|https://federalnewsnetwork.com/cloud-computing/2019/08/dhs-letting-its-components-smart-strategy-guide-its-own-cloud-journey/]]|CloudSmart|
|2019.08.15|NextGov|[[Cloud Smarter|https://www.nextgov.com/cio-briefing/2019/08/cloud-smarter/159163/]]|CloudSmart|
|2019.08.15|GovLoop|[[DoD's JEDI Cloud: How It Might Impact Your Agency|https://www.govloop.com/dods-jedi-cloud-how-it-might-impact-your-agency/]]|Government JEDI|
|2019.08.15|JD Supra|[[IRS Issues Proposed Regulations Classifying Cloud Transactions and Transfers of Digital Content for U.S. Federal Income Tax Purposes|https://www.jdsupra.com/legalnews/irs-issues-proposed-regulations-19290/]]|Regulations|
|2019.08.15|Dark Reading|[[7 Biggest Cloud Security Blind Spots|https://www.darkreading.com/cloud/7-biggest-cloud-security-blind-spots/d/d-id/1335493]]|Threats|
|2019.08.15|TechRepublic|[[How to SSH into an AWS instance|https://www.techrepublic.com/article/how-to-ssh-into-an-aws-instance/]]|AWS SSH|
|2019.08.15|//Security Intelligence//|[[3 Barriers to Identity and Access Management (IAM) Modernization|https://securityintelligence.com/posts/3-barriers-to-identity-and-access-management-iam-modernization/]]|IDaaS IAM|
|2019.08.15|//Azure//|[[Azure Ultra Disk Storage: Microsoft's service for your most I/O demanding workloads|https://azure.microsoft.com/en-us/blog/azure-ultra-disk-storage-microsoft-s-service-for-your-most-i-o-demanding-workloads/]]|Misc|
|2019.08.15|//Azure//|[[Announcing the general availability of Azure Ultra Disk Storage|https://azure.microsoft.com/en-us/blog/announcing-the-general-availability-of-azure-ultra-disk-storage/]]|Misc|
|2019.08.15|//Rapid7//|[[Responding to Cloud-Based Security Incidents with InsightConnect: AWS Security Hub|https://blog.rapid7.com/2019/08/15/responding-to-cloud-based-security-incidents-with-insightconnect-aws-security-hub/]] (3/3)|Incident_Handling AWS|
|2019.08.15|//Avanan//|[[MetaMorph HTML Obfuscation Phishing Attack|https://www.avanan.com/resources/metamorph-html-obfuscation-phishing-attack]]|Phishing O365|
|>|>|>|!2019.08.14|
|2019.08.14|GBHackers on Security|[[MaaS - Rent an Android Malware "Cerberus" From Underground Forums To Control Any Android Device Remotely|https://gbhackers.com/android-malware-cerberus/]]|MaaS|
|2019.08.14|Security Boulevard|[[The Cloud, Outages and You: Who's Responsible for What?|https://securityboulevard.com/2019/08/the-cloud-outages-and-you-whos-responsible-for-what/]]|Shared_Responsibility|
|2019.08.14|Solutions Review|[[How to Design a Flawless Cloud Security Strategy|https://solutionsreview.com/cloud-platforms/how-to-design-a-flawless-cloud-security-strategy/]]|Strategy|
|2019.08.14|CIO Dive|[[5 cloud dos and don'ts|https://www.ciodive.com/news/5-cloud-dos-and-donts/560878/]]|Strategy|
|2019.08.14|CSO|[[Securing Your Multi-Cloud Strategy|https://www.csoonline.com/article/3432121/securing-your-multi-cloud-strategy.html]]|MultiCloud|
|2019.08.14|Forbes|[[Shadow IT: You Can't Protect What You Can't See|https://www.forbes.com/sites/insights-ibmresiliency/2019/08/14/shadow-it-you-cant-protect-what-you-cant-see/]]|Shadow_IT|
|2019.08.14|DZone|[[End-to-End Tests: Managing Containers in Kubernetes|https://dzone.com/articles/end-to-end-tests-managing-containers-in-kubernetes]]|Kubernetes|
|2019.08.14|The Federal Register|[[Classification of Cloud Transactions and Transactions Involving Digital Content|https://www.federalregister.gov/documents/2019/08/14/2019-17425/classification-of-cloud-transactions-and-transactions-involving-digital-content]]|Legal|
|2019.08.14|GovLoop|[[DoD's JEDI Cloud: The Saga So Far|https://www.govloop.com/dods-jedi-cloud-the-saga-so-far/]]|Government JEDI|
|2019.08.14|Dark Reading|[[Microservices Flip App Security on Its Head|https://www.darkreading.com/cloud/microservices-flip-app-security-on-its-head/a/d-id/1335483]]|MicroServices|
|2019.08.14|//Predica.pl//|[[Cloud Governance (pdf)|https://predica.pl/wp-content/uploads/2019/08/Cloud-Governance-min.pdf]]|Governance|
|2019.08.14|//CloudPassage//|[[What the 2019 AWS Security Report Tells Us About Preventing a Cloud Data Breach|https://blog.cloudpassage.com/2019/08/14/2019-aws-security-report/]] ([[rapport|https://pages.cloudpassage.com/AWS-Cloud-Security-Report.html]])|Report AWS CloudPassage|
|2019.08.14|//Alibaba//|[[Why You Should Use Reverse Proxies on Alibaba Cloud|https://medium.com/@Alibaba_Cloud/why-you-should-use-reverse-proxies-on-alibaba-cloud-11eb6e5c5c42]]|Architecture|
|2019.08.14|//Alibaba//|[[How to Install and Configure VNC on an Alibaba Cloud ECS Instance|https://medium.com/@Alibaba_Cloud/how-to-install-and-configure-vnc-on-an-alibaba-cloud-ecs-instance-f8bb6cfbe76f]]|Remote_Access|
|2019.08.14|//Fugue//|[[What Executives Should Know About the Capital One Breach|https://www.fugue.co/blog/what-executives-should-know-about-the-capital-one-breach]]|Incident CapitalOne|
|2019.08.14|//PivotPoint Security//|[[Analysis of the Capital One Breach|https://www.pivotpointsecurity.com/blog/analysis-of-the-capital-one-breach/]]|Incident CapitalOne|
|2019.08.14|//VirSec//|[[Capital One Experiences Third Largest Financial Hack from AWS Insider|https://virsec.com/capital-one-experiences-third-largest-financial-hack-from-aws-insider/]]|Incident CapitalOne|
|2019.08.14|//Azure//|[[Geo Zone Redundant Storage in Azure now in preview|https://azure.microsoft.com/en-gb/blog/geo-zone-redundant-storage-in-azure-now-in-preview/]]|Azure Resilience|
|2019.08.15|//Azure//| → [[Geo-redundant storage (GRS): Cross-regional replication for Azure Storage|https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs]]|Azure Resilience|
|2019.08.15|CBR Online| → [[Azure Aims for Resilience in Face of Regional Catastrophe|https://www.cbronline.com/news/azure-redundancy-gzrs]]|Azure Resilience|
|>|>|>|!2019.08.13|
|2019.08.13|NCSC UK|![[Offline backups in an online world|https://www.ncsc.gov.uk/blog-post/offline-backups-in-an-online-world]]|Backups|
|2019.08.13|MSP Alliance|[[The MSP's Survival Guide to Cloud Nationalism|https://members.mspalliance.com/the-msps-survival-guide-to-cloud-nationalism/]] (incription requise)|MSP|
|2019.08.13|TechBeacon|[[Zero-trust in a cloud-native world: Best practices emerge|https://techbeacon.com/security/zero-trust-cloud-native-world-best-practices-emerge]]|Zero_Trust|
|2019.08.13|Federal News Network|[[Air Force cloud had 54 vulnerabilities before hackers found them|https://federalnewsnetwork.com/air-force/2019/08/air-force-cloud-had-54-vulnerabilities-before-hackers-found-them/]]|Bug_Bounty|
|2019.08.13|Defense One| → [[New Tool Reveals Big Vulnerabilities In Mobile Apps That Use Multiple Clouds|https://www.defenseone.com/technology/2019/08/new-tool-reveals-big-vulnerabilities-mobile-apps-use-multiple-clouds/159133/]]|Conference Mobile|
|2019.08.13|//AWS//|[[Amazon Letter to Sen Wyden RE Consumer Data|https://www.wyden.senate.gov/imo/media/doc/081319%20Amazon%20Letter%20to%20Sen%20Wyden%20RE%20Consumer%20Data.pdf]] (pdf)|Incident CapitalOne AWS|
|2019.08.16|Cyberscoop| → [[Amazon Web Services finds no 'significant issues' at other companies allegedly breached by Paige Thompson|https://www.cyberscoop.com/capital-one-aws-companies-wyden-letter/]]|Incident CapitalOne AWS|
|2019.08.13|//Security Intelligence//|[[Bypass the Cost of Ownership With Security-as-a-Service (SECaaS)|https://securityintelligence.com/posts/bypass-the-cost-of-ownership-with-security-as-a-service-secaas/]]|SECaaS|
|2019.08.13|//Rapid7//|[[Cloud Security Primer: The Basics You Need to Know|https://blog.rapid7.com/2019/08/13/cloud-security-primer-the-basics-you-need-to-know/]]|Misc|
|2019.08.13|//Rhino Security Labs//|[[Bypassing IP Based Blocking with AWS API Gateway|https://rhinosecuritylabs.com/aws/bypassing-ip-based-blocking-aws/]]|APIs|
|2019.08.13|//Lacework//|[[Cloud Anomaly Detection and Vulnerability Assessment Needs to Yield Actionable Alerts|https://www.lacework.com/cloud-anomaly-detection-alerts/]]|Detection|
|2019.08.13|//Clearswift//|[[Capital One Data Breach: A reminder to lock your back door|https://www.clearswift.com/blog/2019/08/13/capital-one-data-breach-reminder-lock-your-back-door]]|Incident CapitalOne|
|2019.08.13|//BitDefender//|[[Best Practices for Cloud Workload Protection - Redesigning Cybersecurity for Cloud-First Businesses|https://businessinsights.bitdefender.com/best-practices-for-cloud-workload-protection-redesigning-cybersecurity-for-cloud-first-businesses]]|CWPP Workload Protection|
|2019.08.13|//Cofense//|[[Phishing Campaigns Imitating CEOs Bypass Microsoft Gateway to Target Energy Sector|https://cofense.com/phishing-campaigns-imitating-ceos-bypass-microsoft-gateway-target-energy-sector/]]|Phishing|
|2019.08.13|//Fortinet//|[[The Bi-Directional Cloud Highway: Critical Insights into Today's Cloud Infrastructures|https://www.fortinet.com/blog/industry-trends/ihs-markit-fortinet-cloud-report-insights.html]]|Report Fortinet|
|2019.08.16|Solutions Review| → [[74% of Companies Move Apps To the Cloud, Then Back On-Premise|https://solutionsreview.com/cloud-platforms/74-of-companies-move-apps-to-the-cloud-then-back-on-premise/]]|Report Fortinet|
|>|>|>|!2019.08.12|
|2019.08.12|iNSYNQ|![[Company Update Concerning the Megacortex Ransomware Attack|https://blog.insynq.com/blog/company-update-concerning-the-megacortex-ransomware-attack]]|Attacks Ransomware iNSYNQ|
|2019.08.16|The Daily Swig| → [[Hosted accountancy software firm iNSYNQ offers ransomware post-mortem|https://portswigger.net/daily-swig/hosted-accountancy-software-firm-insynq-offers-ransomware-post-mortem]]|Attacks Ransomware iNSYNQ|
|2019.08.12|Alliancy[>img[iCSF/flag_fr.png]]|[[Le cloud fait sauter les verrous du partage de données|https://www.alliancy.fr/expertise/cloud/2019/08/12/le-cloud-fait-sauter-les-verrous-du-partage-de-donnees]]|Data_Sharing|
|2019.08.12|Breaking Defense|[[Big Data For Big Wars: JEDI vs. China & Russia|https://breakingdefense.com/2019/08/big-data-for-big-wars-jedi-vs-china-russia/]]|Government JEDI|
|2019.08.12|Silicon|[[Understanding hybrid cloud security across your enterprise|https://www.silicon.co.uk/cloud/understanding-hybrid-cloud-security-277901]]|Hybrid_Cloud|
|2019.08.12|CS Hub|[[Moving To The Cloud: Considerations Beyond The Bottom Line|https://www.cshub.com/cloud/articles/moving-to-the-cloud-considerations-beyond-the-bottom-line]]|Migration|
|2019.08.12|Hackernoon|![[Severe Truth About Serverless Security and Ways to Mitigate Major Risks|https://hackernoon.com/severe-truth-about-serverless-security-and-ways-to-mitigate-major-risks-cd3i3x6f]]|FaaS Serverless Risks|
|2019.08.12|Georgia Tech|[[Smartphone Apps May Connect to Vulnerable Backend Cloud Servers|https://www.news.gatech.edu/2019/08/12/smartphone-apps-may-connect-vulnerable-backend-cloud-servers]]|Conference Mobile|
|2019.08.13|USENIX Security Symposium| → The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based Mobile Backends ([[Présentation|https://www.usenix.org/sites/default/files/conference/protected-files/sec19_slides_alrawi.pdf]], [[rapport|https://admin.govexec.com/media/sec19-alrawi_0.pdf]])|Conference Mobile|
|2019.08.19|Diginomica| → [[Cloud-based app backends - a rat's nest of mobile phone security vulnerabilities|https://diginomica.com/cloud-based-app-backends-rats-nest-mobile-phone-security-vulnerabilities]]|Conference Mobile|
|2019.08.12|//PaloAlto Networks//|![[Hunting the Public Cloud for Exposed Hosts and Misconfigurations|https://unit42.paloaltonetworks.com/hunting-the-public-cloud-for-exposed-hosts-and-misconfigurations/]]|Report PaloAlto Misconfigurations|
|2019.08.15|The Register| → [[Fancy a career exposing cloud data leaks? Great news, companies are still largely clueless|https://www.theregister.co.uk/2019/08/16/cloud_security_sucks/]]|Report PaloAlto Misconfigurations|
|2019.08.12|//Lacework//|[[Developing a Cloud & Container Incident Response Plan|https://www.lacework.com/cloud-container-incident-response-plan/]]|Container Incident_Response|
|2019.08.12|//Lacework//|[[A Quick Guide to Container Orchestration Vulnerabilities|https://www.lacework.com/guide-container-orchestration-vulnerabilities/]]|Container Vulnerabilities|
|2019.08.12|//Chef//|[[Cloud Security Assessments in AWS|https://blog.chef.io/2019/08/12/cloud-security-assessments-in-aws/]]|AWS Assessment|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Août 2019]]>>
!"//What is personal data under the GDPR?//"[>img(100px,auto)[iCSA/CSAdoc.png]]
<<<
//A fundamental concept of the European General Data Protection Regulation (GDPR), which came into force May last year, is personal data.//
<<<
&rArr; https://gdpr.cloudsecurityalliance.org/resource-center/what-is-personal-data-under-the-gdpr
&rArr; http://www.csa-gdpr-build.s3-website-us-east-1.amazonaws.com/artifact/What-is-personal-data-under-the-GDPR.pdf 
!"//Egregious 11 Meta-Analysis Part 1: (In)sufficient Due Diligence and Cloud Security Architecture and Strategy//"
[>img(200px,auto)[iCSA/J8DBE.jpg]]Premier article d'une série, publié le 13 août 2019 — Rédigé par Victor Chin, Research Analyst, CSA
<<<
On August 6th, 2019, the CSA Top Threats working group released the third iteration of the Top Threats to Cloud Computing report.

This time the report highlights eleven egregious security issues based on the survey of 241 industry experts. The following security issues from the previous iteration ("The Treacherous Twelve") appeared again in the latest report.
* Data Breaches
* Account Hijacking
* Insider Threats
* Insecure Interfaces and APIs
* Abuse and Nefarious Use of Cloud Services

At the same time, five new security issues below made their debuts.
* Misconfiguration and Insufficient Change Control
* Lack of Cloud Security Architecture and Strategy
* Weak Control Plane
* Metastructure and Applistructure Failures
* Limited Cloud Usage Visibility made their debuts.
[...]
Before we go into the meta-analysis of The Egregious Eleven, it is important to note that the Top Threats to Cloud Computing reports focus on identifying prominent security issues in the industry based on perception. It is not meant to be the definitive list of security issues in the cloud - instead, the study measures what industry experts perceive the key security issues to be.

__The Overarching Trends__
Throughout the three iterations of the report, one particular trend has been increasingly more prominent. Traditional cloud security issues stemming from concerns about having a third-party provider are being perceived as less relevant. Some examples of such issues are Data Loss, Denial of Service, and Insufficient Due Diligence. While more nuanced issues pertaining specifically to cloud environments are increasingly being perceived as more problematic. These include Lack of Cloud Security Architecture and Strategy, Weak Control Plane and Metastructure and Applistructure Failures.

__Most and Least Relevant Security Issues__
Over the next few weeks, we will examine and try to account for the trend mentioned earlier. Each blog post will feature a security issue that is being perceived as less relevant and one that is being perceived as more relevant. In the first post, we will take a closer look at Insufficient Due Diligence and Lack of Cloud Security Architecture and Strategy.

__(In)sufficient Due Diligence__
Insufficient Due Diligence was rated 8th and 9th in the first and second iteration of the Top Threats to Cloud Computing report, respectively. In the current report, it has completely dropped off. Insufficient Due Diligence refers to prospective cloud customers conducting cloud service provider (CSP) evaluations to ensure that the CSPs meets the various business and regulatory requirements. Such concerns were especially pertinent during the early years of cloud computing, where there were not many resources available to help cloud customers make that evaluation.

__Frameworks to Improve Cloud Procurement__
Since then, many frameworks and projects have been developed to make cloud procurement a smooth journey. The Cloud Security Alliance (CSA), for example, has several tools to help enterprises on their journey of cloud procurement and migration.
* The Consensus Assessment Initiative Questionnaire ([[CAIQ]]) is a set of questions tailored to helped cloud customers evaluate the security posture of prospective cloud providers. It is based on CSA's Cloud Controls Matrix (CCM), which is a cloud security controls framework.
* The CAIQ and CCM are further supported by the Security, Trust and Assurance Registry ([[STAR]]) program, which is a multi-level assurance framework. The STAR program makes CSP information such as completed CAIQs (Level 1) and third-party audit certifications (Level 2) publicly accessible.

Around the world, we see many similar frameworks and guidances being developed. For example:
* The Federal Risk and Authorization Management Program (FedRAMP) in the US
* Multi-Tier Cloud Security (MTCS) Certification Scheme in Singapore
* The European Security Certification Framework (EU-SEC) in the European Union.

With so many governance, risk and compliance support programs being developed globally, it is understandable that Insufficient Due Diligence has fallen off the Top Threats to Cloud Computing list.

__Examining Lack of Cloud Security Architecture and Strategy__
Lack of Cloud Security Architecture and Strategy was rated third in The Egregious Elven. Large organizations migrating their information technology stack to the cloud without considering the nuances of IT operations in the cloud environment are creating a significant amount of business risk for themselves. Such organizations fail to plan for the shortcomings that they will experience operating their IT stack in the cloud. Moving workloads to the cloud will result in organizations having less visibility and control over their data and the underlying cloud infrastructure. Coupled with the self-provisioning and on-demand nature of cloud resources, it becomes very easy to scale up cloud resources - sometimes, in an insecure manner. For example, in 2019, Accenture left at least 4 cloud storage buckets unsecured and publicly downloadable. In highly complex and scalable cloud environments without proper cloud security architecture and processes, such misconfigurations can occur easily. For cloud migration and operations to go smoothly, such shortcomings must be accounted for. Organizations can engage a Cloud Security Access Broker (CASB) or use cloud-aware technology to provide some visibility into the cloud infrastructure. Being able to monitor your cloud environment for misconfigurations or exposures will be extremely critical when operating in the cloud.

On a different note, the fact that a Lack of Cloud Security Architecture and Strategy is high up in the Top Threats to Cloud Computing is evidence that organizations are actively migrating to the cloud. These nuanced cloud security issues only crop up post-migration and will be the next tranche of problems for which solutions must be found.
[...]
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/13/egregious-11-meta-analysis-part-1-insufficient-due-diligence-and-cloud-security-architecture-and-strategy/]] sur le blog de la CSA.
!1 - Les nouveautés CSA de la semaine du 5 au 11 août 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Enjeux et bonnes pratiques dans la sécurisation des conteneneurs et des micro-services''+++*[»]> <<tiddler [[2019.08.08 - Blog : Enjeux et bonnes pratiques dans la sécurisation des conteneneurs et des micro-services]]>>=== 
* Blog : ''A la découverte des principales menaces du Cloud avec Jim Reavis''+++*[»]> <<tiddler [[2019.08.08 - Blog : A la découverte des principales menaces du Cloud avec Jim Reavis]]>>=== 
* Publication : ''Les 6 fondements du DevSecOps''+++*[»]> <<tiddler [[2019.08.07 - Publication : 'Six Pillars of DevSecOps']]>>=== 
* Blog : ''Cloud et cyber-harcèlement''+++*[»]> <<tiddler [[2019.08.07 - Blog : Cloud et cyber-harcèlement]]>>=== 
* Publication : ''Les 11 menaces les plus sérieuses affectant le Cloud''+++*[»]> <<tiddler [[2019.08.06 - Publication : 'Top Threats to Cloud Computing: Egregious Eleven']]>>=== 
* Blog : ''Projet Libra de Facebook''+++*[»]> <<tiddler [[2019.08.05 - Blog : Projet Libra de Facebook]]>>=== 
!2 - Veille Web
La [[Veille Web|2019.08.11 - Veille Hebdomadaire]] avec plus de 90 liens :
* Piratages et fuites de données : des précisions et des commentaires suite aux attaques contre ''Capital One'' et ''iNSYNQ'', risques de fuites dans AWS EBS
* Rapports et sondages : ''FileCloud'', ''Kubernetes'' (rapport d'audit), ''Vectra'', ''Wipro''
* Attaques : phishing
* Divers : les présentations données lors de la conférence ''BlackHat'', ''Azure Security Lab'', le jeu Cloud de l'été de ''Nuageo''
!3 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Août|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.08.11|
|2019.08.11|DEF CON 27|[[I'm In Your Cloud... Pwning Your Azure Environement|https://www.defcon.org/html/defcon-27/dc-27-speakers.html#Mollema]]|AWS AzureAD Exploit|
|2019.08.11|DEF CON 27|[[Owning The Cloud Through Server-Side Request Forgery|https://www.defcon.org/html/defcon-27/dc-27-speakers.html#Sadeghipour]]|Exploit SSRF|
|2019.08.11|//CyStack//|[[Subdomain takeover - Chapter two: Azure Services|https://blog.cystack.net/subdomain-takeover-chapter-two-azure-services/]]|DNS AWS|
|>|>|>|!2019.08.10|
|2019.08.10|Defense One|[[Pentagon Officials Explain Why the Controversial JEDI Cloud Is Crucial for Future Ops|https://www.defenseone.com/technology/2019/08/pentagon-reveals-why-controversial-jedi-cloud-crucial-future-ops/159088/]]|Government JEDI|
|>|>|>|!2019.08.09|
|2019.08.09|Bleeping Computer|[[Microsoft 365 to Get Enhanced Suspicious Content Submission|https://www.bleepingcomputer.com/news/security/microsoft-365-to-get-enhanced-suspicious-content-submission/]]|O365|
|2019.08.09|Bleeping Computer|[[Microsoft Office Phishers Move to Enterprise AWS Landing Pages|https://www.bleepingcomputer.com/news/security/microsoft-office-phishers-move-to-enterprise-aws-landing-pages/]]|AWS Phishing|
|2019.08.09|Krebs On Security|![[iNSYNQ Ransom Attack Began With Phishing Email|https://krebsonsecurity.com/2019/08/insynq-ransom-attack-began-with-phishing-email/]]|Attacks Ransomware iNSYNQ|
|2019.08.09|CRN| → [[iNSYNQ Ransomware Attack Started With Phishing Email: Report|https://www.crn.com/news/cloud/insynq-ransomware-attack-started-with-phishing-email-report]]|Attacks Ransomware iNSYNQ|
|2019.08.09|CBR Online|[[Default Access for 'Everyone'? New AWS Data Lake Service's Settings Raise Red Flags for Security Experts|https://www.cbronline.com/news/default-access-for-everyone-new-aws-lake-formation-service-configurations-raise-eyebrows]]|AWS|
|2019.08.09|ZDnet|[[Microsoft is phasing out the Basic edition of Azure Active Directory|https://www.zdnet.com/article/microsoft-is-phasing-out-the-basic-edition-of-azure-active-directory/]]|AzureAD EndOfLife|
|2019.08.09|UKAuthority|[[Scotland gets cloud procurement framework|https://www.ukauthority.com/articles/scotland-gets-cloud-procurement-framework/]]|Government Scotland|
|2019.08.09|DEF CON 27|[[More Keys Than A Piano: Finding Secrets In Publicly Exposed Ebs Volumes|https://www.defcon.org/html/defcon-27/dc-27-speakers.html#Morris]]|AWS Data_Leak|
|2019.08.09|TechCrunch| → [[Hundreds of exposed Amazon cloud backups found leaking sensitive data|https://techcrunch.com/2019/08/09/aws-ebs-cloud-backups-leak/]]|AWS Data_Leak|
|2019.08.09|//SecurityIntelligence//|[[How Implementing Cloud Identity Can Improve Security and Data Privacy|https://securityintelligence.com/articles/how-implementing-cloud-identity-can-improve-security-and-data-privacy/]]|IAM|
|2019.08.09|//Rackspace//|[[A Fresh Look for Rackspace's Open Cloud Academy|https://blog.rackspace.com/fresh-look-rackspaces-open-cloud-academy-technical-training]]|Education Training|
|2019.08.09|//CyberDB//|[[Serverless Security: Best Practices to Secure your Serverless Infrastructure|https://www.cyberdb.co/serverless-security-best-practices/]]|Serverless Best_Practices|
|>|>|>|!2019.08.08|
|2019.08.08|AccountingToday|![[Inside the Insynq attack: 'We had to assume they were listening'|https://www.accountingtoday.com/news/inside-the-insynq-ransomware-attack-we-had-to-assume-they-were-listening]]|Attacks Ransomware iNSYNQ|
|2019.08.08|SecurityWeek|[[Vulnerability in Kubernetes Allows Access to Custom Resources|https://www.securityweek.com/vulnerability-kubernetes-allows-access-custom-resources]]|CVE-2019-11247 Kubernetes|
|2019.08.08|Container Journal| → [[CRD Vulnerability Cause for Kubernetes Concern|https://containerjournal.com/2019/08/09/crd-vulnerability-cause-for-kubernetes-concern/]]|CVE-2019-11247 Kubernetes|
|2019.08.08|NextGov|[[GSA Cyber Expert Offers Tips on Cloud Security|https://www.nextgov.com/cybersecurity/2019/08/gsa-cyber-expert-offers-tips-cloud-security/159046/]]|Best_Practices|
|2019.08.08|Brink|[[The Threat from the Cloud: How Cyber Intruders Exploit Third Parties|https://www.brinknews.com/the-threat-from-the-cloud-how-cyber-intruders-exploit-third-parties/]]|Third_Party|
|2019.08.08|Information Security Newspaper|[[Simple reasons why the Microsoft Azure cloud isn't secure|https://www.securitynewspaper.com/2019/08/08/simple-reasons-why-the-microsoft-azure-cloud-isnt-secure/]]|Azure RDP|
|2019.08.08|BlackHat|[[Securing Apps in the Open-By-Default Cloud|https://www.blackhat.com/us-19/briefings/schedule/#securing-apps-in-the-open-by-default-cloud-16428]] ([[slides|us-19-Howes-Securing-Apps-In-The-Open-By-Default-Cloud.pdf]])|Best_Practices BlackHat|
|2019.08.08|BlackHat|[[A Compendium of Container Escapes|https://www.blackhat.com/us-19/briefings/schedule/#preventing-authentication-bypass-a-tale-of-two-researchers-17041]] ([[slides|http://i.blackhat.com/USA-19/Thursday/us-19-Edwards-Compendium-Of-Container-Escapes.pdf]])|Containers BlackHat|
|2019.08.08|BlackHat|[[DevSecOps : What, Why and How|https://www.blackhat.com/us-19/briefings/schedule/#devsecops--what-why-and-how-17058]] ([[slides|http://i.blackhat.com/USA-19/Thursday/us-19-Shrivastava-DevSecOps-What-Why-And-How.pdf]])|DevSecOps BlackHat|
|2019.08.08|//Nuageo//[>img[iCSF/flag_fr.png]]|[[On the road to the Cloud - Le jeu de l'été Nuageo|https://www.nuageo.fr/2019/08/le-jeu-de-lete-nuageo-2019/]]|Fun|
|2019.08.08|//FileCloud//|[[FileCloud Releases Inaugural Annual Enterprise Cloud & Data Security Report|https://vmblog.com/archive/2019/08/08/filecloud-releases-inaugural-annual-enterprise-cloud-data-security-report.aspx]] ([[rapport|https://www.getfilecloud.com/annual-enterprise-cloud-data-security-report/]])|Report FileCloud|
|2019.08.08|BetaNews| → [[Half of companies won't move mission critical workloads to the cloud|https://betanews.com/2019/08/08/mission-critical-workloads-not-cloud/]]|Report FileCloud|
|2019.08.08|//Google//|[[Awarding Google Cloud Vulnerability Research|https://security.googleblog.com/2019/08/awarding-google-cloud-vulnerability.html]]|Vulnerability_Reward|
|2019.08.08|//PaloAlto Networks//|[[From 'DevOps vs. SecOps' to DevSecOps|https://blog.paloaltonetworks.com/2019/08/devops-vs-secops-devsecops/]]|DevSecOps|
|2019.08.08|//Symantec//|[[How to Protect Yourself in the Cloud: Tips and Best Practices|https://www.symantec.com/blogs/expert-perspectives/how-protect-yourself-cloud-tips-and-best-practices]]|Report Kubernetes AuditBest_Practices|
|2019.08.08|//Proofpoint//|[[Phishing Actor Using XOR Obfuscation Graduates to Enterprise Cloud Storage on AWS|https://www.proofpoint.com/us/threat-insight/post/phishing-actor-using-xor-obfuscation-graduates-enterprise-cloud-storage-aws]]|Phishing AWS Azure|
|2019.08.08|BetaNews| → [[Russian phishing campaign using AWS to host landing pages designed to avoid detection|https://www.techrepublic.com/article/russian-phishing-campaign-using-aws-to-host-landing-pages-designed-to-avoid-detection/]]|Phishing AWS Azure|
|2019.08.08|TechRepublic| → [[Russian phishing campaign using AWS to host landing pages designed to avoid detection|https://www.techrepublic.com/article/russian-phishing-campaign-using-aws-to-host-landing-pages-designed-to-avoid-detection/]]|Phishing AWS Azure|
|2019.08.08|//ThreatPost//| → [[Phishing Attacks Enlist Amazon AWS, Microsoft Azure in Ploys|https://threatpost.com/phishing-amazon-aws-s3-cloud-buckets/147111/]]|Phishing AWS Azure|
|2019.08.08|//Tripwire//|[[Best Practices for IT Security Teams in the Age of Cloud|https://www.tripwire.com/state-of-security/security-data-protection/cloud/best-practices-security-teams-cloud/]]|Best_Practices|
|2019.08.08|//Managed Methods//|[[Top Data Loss Prevention Methods For Cloud Applications|https://managedmethods.com/blog/data-loss-prevention-methods-for-cloud-apps/]]|DLP|
|2019.08.08|//G2//|[[Securely Migrating to the Cloud|https://learn.g2.com/cloud-migration]]|Migration|
|2019.08.08|//Sensu//|[[How Kubernetes works|https://blog.sensu.io/how-kubernetes-works]]|Kubernetes|
|2019.08.08|//CyberArk//|[[Kubernetes Pentest Methodology Part 1|https://www.cyberark.com/threat-research-blog/kubernetes-pentest-methodology-part-1/]] (1/3)|Kubernetes PenTest|
|2019.08.08|//WeScale//[>img[iCSF/flag_fr.png]]|[[Observabilité, résilience et expérience au secours des systèmes chaotiques|https://blog.wescale.fr/2019/08/08/observabilite-resilience-et-experience-au-secours-des-systemes-chaotiques/]]|Chaos_Engineering|
|2019.08.08|//Cloudonaut//|[[Review: AWS Backup - A centralized place for managing backups?|https://cloudonaut.io/review-aws-backup/]]|AWS Backups|
|>|>|>|!2019.08.07|
|2019.08.07|!CSA|[[CSA Releases "The Six Pillars of DevSecOps" Report|https://cloudsecurityalliance.org/articles/csa-releases-the-six-pillars-of-devsecops-report/]]|CSA DevSecOps|
|2019.08.07|CBR Online| → [[DevSecOps: The Six Pillars of Secure Code Deployment|https://www.cbronline.com/list/devsecops-guide-six-pillars]]|CSA DevSecOps|
|2019.08.07|BlackHat|![[Attacking and Defending the Microsoft Cloud (Office 365 & Azure AD)|https://www.blackhat.com/us-19/briefings/schedule/#attacking-and-defending-the-microsoft-cloud-office---azure-ad-14553]] (slides [[ici|https://adsecurity.org/?p=4179]] et [[là|http://i.blackhat.com/USA-19/Wednesday/us-19-Metcalf-Attacking-And-Defending-The-Microsoft-Cloud.pdf]])|Azure Attacks BlackHat|
|2019.08.07|BlackHat|[[Internet-Scale Analysis of AWS Cognito Security|https://www.blackhat.com/us-19/briefings/schedule/#internet-scale-analysis-of-aws-cognito-security-15829]]|AWS BlackHat|
|2019.08.07|BlackHat|[[Exploiting the Hyper-V IDE Emulator to Escape the Virtual Machine|https://www.blackhat.com/us-19/briefings/schedule/#exploiting-the-hyper-v-ide-emulator-to-escape-the-virtual-machine-15862]]|Azure Hyper-V BlackHat|
|2019.08.07|BlackHat|[[The Path Less Traveled: Abusing Kubernetes Defaults|https://www.blackhat.com/us-19/briefings/schedule/#the-path-less-traveled-abusing-kubernetes-defaults-17049]]|Kubernetes BlackHat|
|2019.08.07|BlackHat|[[Controlled Chaos: The Inevitable Marriage of DevOps & Security|https://www.blackhat.com/us-19/briefings/schedule/#controlled-chaos-the-inevitable-marriage-of-devops--security-15273]] ([[slides|http://i.blackhat.com/USA-19/Wednesday/us-19-Shortridge-Controlled-Chaos-The-Inevitable-Marriage-Of-DevOps-And-Security.pdf]])|DevSecOps Chaos_Engineering BlackHat|
|2019.08.07|ComputerWeekly|[[The $10bn question: Why is the US government's JEDI cloud contract taking so long to award?|https://www.computerweekly.com/news/252468011/The-10bn-question-Why-is-the-US-governments-decade-long-cloud-contract-taking-so-long-to-award]]|Government JEDI|
|2019.08.07|TechRepublic|[[How the Air Force used a bug bounty program to hack its own cloud server|https://www.techrepublic.com/article/how-the-air-force-used-a-bug-bounty-program-to-hack-its-own-cloud-server/]]|Bug_Bounty|
|2019.08.07|GovLoop|[[There Are No Such Things as 'Average' Cloud Users|https://www.govloop.com/theres-no-such-thing-as-average-cloud-users/]]|Misc|
|2019.08.07|//Vectra//|![[Vectra research reveals that the most significant ransomware threat is the malicious encryption of shared network files in cloud service providers|https://www.vectra.ai/news/spotlight-ransomware]] ([[rapport|http://www.vectra.ai/spotlight-ransomware]] et [[infographie|http://www.vectra.ai/spotlight-ransomware]])|Report Vectra|
|2019.08.07|BetaNews| → [[Biggest ransomware threat is encryption of shared cloud files|https://betanews.com/2019/08/07/biggest-ransomware-threat-is-encryption-of-shared-cloud-files/]]|Report Vectra|
|2019.08.07|Dark Reading| → [[Enterprises Must Be Wary of Ransomware Targeting Network File Shares & Cloud Assets|https://www.darkreading.com/attacks-breaches/enterprises-must-be-wary-of-ransomware-targeting-network-file-shares-andcloud-assets/d/d-id/1335466]]|Report Vectra|
|2019.08.07|ComputerWeekly| → [[Shared files in the cloud are a top ransomware target|https://www.computerweekly.com/news/252468021/Shared-files-in-the-cloud-are-a-top-ransomware-target]]|Report Vectra|
|2019.08.07|//Akamai//|[[Top 10 Best Practices for Securing Cloud Workflows|https://blogs.akamai.com/2019/08/top-10-best-practices-for-securing-cloud-workflows.html]]|Best_Practices|
|2019.08.07|//Azure//|[[Better security with enhanced access control experience in Azure Files|https://azure.microsoft.com/en-us/blog/better-security-with-enhanced-access-control-experience-in-azure-files/]]|Azure Access_Controls|
|2019.08.07|//Azure//|[[Disaster recovery of Azure disk encryption (V2) enabled virtual machines|https://azure.microsoft.com/en-us/blog/disaster-recovery-of-azure-disk-encryption-v2-enabled-virtual-machines/]]|Azure Encryption|
|2019.08.07|//Google//|[[How secure are your APIs? Apigee API security reporting can help|https://cloud.google.com/blog/products/apigee/how-secure-are-your-apis-apigee-api-security-reporting-can-help]]API|
|2019.08.07|//Google//|[[Cloud IAP enables context-aware access to VMs via SSH and RDP without bastion hosts|https://cloud.google.com/blog/products/identity-security/cloud-iap-enables-context-aware-access-to-vms-via-ssh-and-rdp-without-bastion-hosts]]|Access_Controls|
|2019.08.07|Bleeping Computer| → [[Google's Cloud IAP Now Generally Available for Cloud VM Clients|https://www.bleepingcomputer.com/news/security/googles-cloud-iap-now-generally-available-for-cloud-vm-clients/]]|Access_Controls|
|2019.08.07|//AssuranceSoftware//|[[Don't Underestimate the Need for Tight Cloud Security|https://www.assurancesoftware.com/product-blog/dont-underestimate-the-need-for-tight-cloud-security]]|Best_Practices|
|2019.08.07|//Lacework//|[[Enhancing Native Kubernetes Security|https://www.lacework.com/enhancing-native-kubernetes-security/]]|Kubernetes Risks Protection|
|2019.08.07|//Azure//|![[A case study in industry collaboration: Poisoned RDP vulnerability disclosure and response|https://www.microsoft.com/security/blog/2019/08/07/a-case-study-in-industry-collaboration-poisoned-rdp-vulnerability-disclosure-and-response/]]|Azure Hyper-V CVE-2019-0887|
|2019.08.07|//Threatpost//| → [[Black Hat 2019: Microsoft Protocol Flaw Leaves Azure Users Open to Attack|https://threatpost.com/black-hat-2019-microsoft-protocol-flaw-leaves-azure-users-open-to-attack/147045/]]|Azure Hyper-V CVE-2019-0887|
|2019.08.07|//Checkpoint & Microsoft//|! → [["He Said, She Said - Poisoned RDP Offense and Defense"|https://www.blackhat.com/us-19/briefings/schedule/#he-said-she-said--poisoned-rdp-offense-and-defense-15602]] ([[présentation|http://i.blackhat.com/USA-19/Wednesday/us-19-Baril-He-Said-She-Said-Poisoned-RDP-Offense-And-Defense.pdf]] et [[rapport|http://i.blackhat.com/USA-19/Wednesday/us-19-Baril-He-Said-She-Said-Poisoned-RDP-Offense-And-Defense-wp.pdf]])|Azure Hyper-V CVE-2019-0887 BlackHat|
|2019.08.07|//Spanning//|[[Forming a Backup Strategy: 4 Steps to Follow|https://spanning.com/blog/backup-strategy-4-steps-to-follow/]]|Backups|
|>|>|>|!2019.08.06|
|2019.08.06|!CSA|[[CSA Releases New Research - Top Threats to Cloud Computing: Egregious Eleven|https://cloudsecurityalliance.org/articles/csa-releases-new-research-top-threats-to-cloud-computing-egregious-eleven/]]|CSA Threats|
|2019.08.06|SecurityWeek| → [[Cloud Providers Improving Security, But Users Need to Up Their Game|https://www.securityweek.com/cloud-providers-improving-security-users-need-their-game]]|CSA Threats|
|2019.08.06|TechRepublic| → [[How to prevent the top 11 threats in cloud computing|https://www.techrepublic.com/article/how-to-prevent-the-top-11-threats-in-cloud-computing/]]|CSA Threats|
|2019.08.06|The Register| → [[Cloud computing's no PICNIC*: Yep, biggest security risks down to customer, not provider|https://www.theregister.co.uk/2019/08/06/the_biggest_security_risks_in_cloud_computing_are_in_the_enterprise_not_in_the_cloud/]]|CSA Threats|
|2019.08.06|Cloud Native Computing Foundation|![[Open Sourcing the Kubernetes Security Audit|https://www.cncf.io/blog/2019/08/06/open-sourcing-the-kubernetes-security-audit/]] ([[Rapport|https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf]] et 2 [[livres|https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/AtredisPartners_Attacking_Kubernetes-v1.0.pdf]] [[blancs|https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20White%20Paper.pdf]])|Report Kubernetes Audit|
|2019.08.06|Kubernetes|! → [[Kubernetes 3rd Party Security Audit Findings #81146|https://github.com/kubernetes/kubernetes/issues/81146]]|Report Kubernetes Audit|
|2019.08.06|Kubernetes|! → [[Security audit WG disclosure process #3982|https://github.com/kubernetes/community/issues/3982]]|Report Kubernetes Audit|
|2019.08.06|SiliconAngle| → [[Security audit reveals 34 vulnerabilities in Kubernetes code|https://siliconangle.com/2019/08/06/34-vulnerabilities-uncovered-security-audit-kubernetes-code/]]|Kubernetes Audit|
|2019.08.06|//PaloAlto Networks//| → [[Kubernetes Penetration Test Report: Insights and Twistlock Response|https://blog.paloaltonetworks.com/2019/08/kubernetes-penetration-test/]]|Kubernetes Audit|
|2019.08.07|Container Journal| → [[CNCF Completes Kubernetes Cybersecurity Audit|https://containerjournal.com/2019/08/07/cncf-completes-kubernetes-cybersecurity-audit/]]|Kubernetes Audit|
|2019.08.07|SDX Central| → [[Kubernetes Looks Inside and Finds Security Holes|https://www.sdxcentral.com/articles/news/kubernetes-looks-inside-and-finds-security-holes/2019/08/]]|Kubernetes Audit|
|2019.08.08|//Snyk//|[[Kubernetes open sourced their security audit. What can we learn?|https://snyk.io/blog/kubernetes-open-sourced-their-security-audit-what-can-we-learn/]]|Kubernetes Audit|
|2019.08.06|(ISC)2|[[Why Certified Cloud Security Professionals are in Higher Demand Than Ever|https://blog.isc2.org/isc2_blog/2019/08/why-certified-cloud-security-professionals-are-in-higher-demand-than-ever.html]]|Education Certification|
|2019.08.06|TechBeacon|[[The state of container security: Tools, policy trail the technology|https://techbeacon.com/security/state-container-security-tools-policy-trail-technology]]|Containers|
|2019.08.06|DZone|[[A Glance at Cloud Monitoring: Strategy, Types and Benefits|https://dzone.com/articles/a-glance-at-cloud-monitoring-strategy-types-and-be]]|Monitoring|
|2019.08.06|//Pure Storage//[>img[iCSF/flag_fr.png]]|[[Flash-to-Flash-to-Cloud : le nouveau modèle de protection des données|https://cyberexperts.tech/flash-to-flash-to-cloud-le-nouveau-modele-de-protection-des-donnees/]]|Protection|
|2019.08.06|//Wipro//|[[Wipro's Third Annual State of Cybersecurity Report Finds Organizations Focusing on IoT and Cloud While Developing Cyber Defense Systems|https://www.businesswire.com/news/home/20190806005558/en/Wipro%E2%80%99s-Annual-State-Cybersecurity-Report-Finds-Organizations]] ([[rapport|https://www.wipro.com/applications/form/the-state-of-cybersecurity-report-2019/]])|Report Wipro|
|2019.08.06|//Qualys//|[[Embracing the cloud and meeting its security demands|https://www.helpnetsecurity.com/2019/08/06/embracing-the-cloud/]]|Misc|
|2019.08.06|//CCSI//|[[BYOD, the Cloud, and CASB, the best combination since PB&J|https://www.ccsinet.com/blog/byod-casb-combination/]]|CASB|
|2019.08.06|//Alibaba//|[[Best Practices of Log Analysis and Monitoring by Using Kubernetes Ingress|https://medium.com/@Alibaba_Cloud/best-practices-of-log-analysis-and-monitoring-by-using-kubernetes-ingress-2650b9181bff]]|Kubernetes Logging|
|2019.08.06|//Alcide//|[[Secret-Hunting in Kubernetes|https://blog.alcide.io/secret-hunting-in-kubernetes]]|Kubernetes|
|>|>|>|!2019.08.05|
|2019.08.05|Les Echos[>img[iCSF/flag_fr.png]]|[[Le cloud du ministère de l'Intérieur, un accélérateur de la transformation numérique|https://www.lesechos.fr/thema/transformation-services-publics/le-cloud-du-ministere-de-linterieur-un-accelerateur-de-la-transformation-numerique-1122281]]|Misc|
|2019.08.05|//Microsoft//|![[Azure Security Lab: a new space for Azure research and collaboration|https://msrc-blog.microsoft.com/2019/08/05/azure-security-lab-a-new-space-for-azure-research-and-collaboration/]]|Azure Bug_Bounty|
|2019.08.05|Bleeping Computer| → [[Microsoft Invites Researchers to Hack Their Azure Security Lab|https://www.bleepingcomputer.com/news/security/microsoft-invites-researchers-to-hack-their-azure-security-lab/]]|Azure Bug_Bounty|
|2019.08.05|Dark Reading| → [[Microsoft Opens Azure Security Lab, Raises Top Azure Bounty to $40K|https://www.darkreading.com/cloud/microsoft-opens-azure-security-lab-raises-top-azure-bounty-to-%2440k/d/d-id/1335441]]|Azure Bug_Bounty|
|2019.08.05|//Akamai//|[[Top 10 Practices for Securing Cloud Workloads|https://blogs.akamai.com/2019/08/top-10-practices-for-securing-cloud-workloads.html]]|Workloads|
|2019.08.05|//Duo Security//|[[5 Best Practices to Secure Microsoft O365 Accounts|https://duo.com/blog/5-best-practices-to-secure-microsoft-o365-accounts]]Best_Practices O365|
|2019.08.05|//Alibaba//|[[New Thoughts on Cloud Native: Why Are Containers Everywhere?|https://medium.com/@Alibaba_Cloud/new-thoughts-on-cloud-native-why-are-containers-everywhere-ada1b7264b64]]|Containers|
|2019.08.05|//eXemplify//|[[Seven Steps to Secure Cloud Migration|http://www.exemplifygroup.com/seven-steps-to-secure-cloud-migration/]]|Migration|
|2019.10.21|//Microsoft//|[[Set up disaster recovery for Azure VMs|https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-azure-tutorial-enable-replication]]|Azure DRP|
|>|>|>|!Incident CapitalOne (2019.07.29)|
|2019.08.05|//Rhino Security Labs//|! → [[The Capital One Breach & "cloud_breach_s3" CloudGoat Scenario|https://rhinosecuritylabs.com/aws/capital-one-cloud_breach_s3-cloudgoat/]]|DataBreach Capital_One|
|2019.08.05|Business Insider| → [[Security researchers warned for years about the cloud-security flaw used in the massive Capital One hack, but Amazon apparently leaves it up to customers to protect|http://www.businessinsider.fr/us/capital-one-hack-vulnerability-on-cloud-amazon-known-for-years-2019-8]]|DataBreach Capital_One|
|2019.08.05|TechTarget| → [[Capital One hack highlights SSRF concerns for AWS|https://searchsecurity.techtarget.com/news/252467901/Capital-One-hack-highlights-SSRF-concerns-for-AWS]]|DataBreach Capital_One|
|2019.08.05|//CloudPassage//| → [[Capital One Data Breach: Non-Technical Tips To Not Be A Headline|https://blog.cloudpassage.com/2019/08/08/capital-one-data-breach/]]|DataBreach Capital_One|
|2019.08.05|//DarkTrace//| → [[Back to square one: The Capital One breach proved we must rethink cloud security|https://www.darktrace.com/en/blog/back-to-square-one-the-capital-one-breach-proved-we-must-rethink-cloud-security/]]|DataBreach Capital_One|
|2019.08.09|GeekWire| → [[Amazon and Capital One face legal backlash after massive hack affects 106M customers|https://www.geekwire.com/2019/amazon-capital-one-face-lawsuits-massive-hack-affects-106m-customers/]]|DataBreach Capital_One|
|2019.08.09|//BitSight//| → [[Cloud Security: Lessons Learned from the Capital One Data Breach|https://www.bitsight.com/blog/cloud-security-lessons-learned-from-capital-one-data-breach]]|DataBreach Capital_One|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Août 2019]]>>
!"//Uncovering the CSA Top Threats to Cloud Computing with Jim Reavis//"
[>img(150px,auto)[iCSA/J88BU.jpg]]Article de blog publié le 8 août 2019 — Rédigé par Greg Jensen, Sr. Principal Director - Security Cloud Business Group, Oracle
<<<
//For the few that attend this year's ''BlackHat conference'' kicking off this week in Las Vegas, many will walk away with an in depth understanding and knowledge on risk as well as actionable understandings on how they can work to implement new strategies to defend against attacks. For the many others who don't attend, Cloud Security Alliance has once again developed their [[CSA Top Threats to Cloud Computing: The Egregious 11|2019.08.06 - Publication : 'Top Threats to Cloud Computing: Egregious Eleven']].
I recently sat down with the CEO and founder of CSA, Jim Reavis, to gain a deeper understanding on what leaders and practitioners can learn from this year's report that covers the [[top 11 threats to cloud computing - The Egregious 11|2019.08.06 - Publication : 'Top Threats to Cloud Computing: Egregious Eleven']].

//''Greg Jensen''// — Jim, for those who have never seen this, what is the CSA Top Threats to Cloud report and who is your target reader?
//''Jim Raevis''// — The CSA Top Threats to Cloud Computing is a research report that is periodically updated by our research team and working group of volunteers to identify high priority cloud security risks, threats and vulnerabilities to enable organizations to optimize risk management decisions related to securing their cloud usage. The Top Threats report is intended to be a companion to CSA's Security Guidance and Cloud Controls Matrix best practices documents by providing context around important threats in order to prioritize the deployment of security capabilities to the issues that really matter.
Our Top Threats research is compiled via industry surveys as well as through qualitative analysis from leading industry experts. This research is among CSA's most popular downloads and has spawned several translations and companion research documents that investigate cloud penetration testing and real world cloud incidents. Top Threats research is applicable to the security practitioner seeking to protect assets, executives needing to validate broader security strategies and any others wanting to understand how cloud threats may impact their organization. We make every effort to relate the potential pitfalls of cloud to practical steps that can be taken to mitigate these risks.

//''Greg''// — Were there any findings in the Top Threats report that really stood out for you?
//''Jim''// — Virtually all of the security issues we have articulated impact all different types of cloud. This is important as we find a lot of practitioners who may narrow their cloud security focus on either Infrastructure as a Service (IaaS) or Software as a Service (SaaS), depending upon their own responsibilities or biases. The cloud framework is a layered model, starting with physical infrastructure with layers of abstraction built on top of it. SaaS is essentially the business application layer built upon some form of IaaS, so the threats are applicable no matter what type of cloud one uses. Poor identity management practices, such as a failure to implement strong authentication, sticks out to me as a critical and eminently solvable issue. I think the increased velocity of the "on demand" characteristic of cloud finds its way into the threat of insufficient due diligence and problems of insecure APIs. The fastest way to implement cloud is to implement it securely the first time.

//''Greg''// — What do you think are some of the overarching trends you've noticed throughout the last 3 iterations of the report?
//''Jim''// — What has been consistent is that the highest impact threats are primarily the responsibility of the cloud user. To put a bit of nuance around this as the definition of a "cloud user" can be tricky, I like to think of this in three categories: a commercial SaaS provider, an enterprise building its own "private SaaS" applications on top of IaaS or a customer integrating a large number of SaaS applications have the bulk of the technical security responsibilities. So much of the real world threats that these cloud users grapple with are improper configuration, poor secure software development practices and insufficient identity and access management strategies.

//''Greg''// — Are you seeing any trends that show there is increasing trust in cloud services, as well as the CSP working more effectively around Shared Responsibility Security Model?
//''Jim''// — The market growth in cloud is a highly quantifiable indicator that cloud is becoming more trusted. "Cloud first" is a common policy we see for organizations evaluating new IT solutions, and it hasn't yet caused an explosion of cloud incidents, although I fear we must see an inevitable increase in breaches as it becomes the default platform.
We have been at this for over 10 years at CSA and have seen a lot of maturation in cloud during that time. One of the biggest contributions we have seen from the CSPs over that time is the amount of telemetry they make available to their customers. The amount and diversity of logfile information customers have today does not compare to the relative "blackbox" that existed when we started this journey more than a decade ago.
Going back to the layered model of cloud yet again, CSPs understand that most of the interesting applications customers build are a mashup of technologies. Sophisticated CSPs understand this shared responsibility for security and have doubled down on educational programs for customers. Also, I have to say that one of the most rewarding aspects of being in the security industry is observing the collegial nature among competing CSPs to share threat intelligence and best practices to improve the security of the entire cloud ecosystem.
One of the initiatives CSA developed that helps promulgate shared responsibility is the CSA ''Security, Trust, Assurance & Risk'' ([[STAR]]) Registry. We publish the answers CSPs provide to our assessment questionnaire so consumers can objectively evaluate a CSP's best practices and understand the line of demarcation and where their responsibility begins.

//''Greg''// — How does the perception of threats, risks and vulnerabilities help to guide an organization's decision making & strategy?
//''Jim''// — This is an example of why it is so important to have a comprehensive body of knowledge of cloud security best practices and to be able to relate it to Top Threats. A practitioner must be able to evaluate using any risk management strategy for a given threat, e.g. risk avoidance, risk mitigation, risk acceptance, etc. If one understand the threats but not the best practices, one will almost always choose to avoid the risk, which may end up being a poor business decision. Although the security industry has gotten much better over the years, we still fight the reputation of being overly conservative and obstructing new business opportunities over concerns about security threats. While being paranoid has sometimes served us well, threat research should be one of a portfolio of tools that helps us embrace innovation.

//''Greg''// — What are some of the security issues that are currently brewing/underrated that you think might become more relevant in the near future?
//''Jim''// — I think it is important to understand that malicious attackers will take the easy route and if they can phish your cloud credentials, they won't need to leverage more sophisticated attacks. I don't spend a lot of time worrying about sophisticated CSP infrastructure attacks like the Rowhammer direct random access memory (DRAM) leaks, although a good security practitioner worries a little bit about everything. I try to think about fast moving technology areas that are manipulated by the customer, because there are far more customers than CSPs. For example, I get concerned about the billions of IoT devices that get hooked into the cloud and what kinds of security hardening they have. I also don't think we have done enough research into how blackhats can attack machine learning systems to avoid next generation security systems.
Our Israeli chapter recently published a fantastic research document on the 12 Most Critical Risks for Serverless Applications. Containerization and Serverless computing are very exciting developments and ultimately will improve security as they reduce the amount of resource management considerations for the developer and shrink the attack surface. However, these technologies may seem foreign to security practitioners used to a virtualized operating system and it is an open question how well our tools and legacy best practices address these areas.
The future will be a combination of old threats made new and exploiting fast moving new technology. CSA will continue to call them as we see them and try to educate the industry before these threats are fully realized.

//''Greg''// — Jim, it's been great hearing from you today on this new Top Threats to Cloud report. Hats off to the team and the contributors for this year's report. Has been great working with them all!//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/08/uncovering-the-csa-top-threats-to-cloud-computing-w-jim-reavis/]] sur le blog de la CSA.
!"//Challenges & Best Practices in Securing Application Containers and Microservices//"
[>img(150px,auto)[iCSA/J88BC.jpg]]Article de blog publié le 7 août 2019 — Rédigé par Anil Karmel, Co-Chair, CSA Application Containers and Microservices (ACM) Working Group
<<<
//Application Containers have a long and storied history, dating back to the early 1960s with virtualization on mainframes up to the 2000s with the release of Solaris and Linux Containers (LXC). The rise of Docker in the early 2010s elevated the significance of Application Containerization as an efficient and reliable means to develop and deploy applications. Coupled with the rise of Microservices as an architectural pattern to decompose applications into fundamental building blocks, these two approaches have become the de facto means for how modern applications are delivered.

As with any new standard, challenges arise in how to secure application containers and microservices. The National Institute of Standards and Technology's (NIST) Cloud Security Working Group launched a group focused on developing initial guidance around this practice area. The Cloud Security Alliance partnered with NIST on development of this guidance and focused on maturing the same culminating in the release of two foundational artifacts, "Challenges in Securing Application Containers and Microservices" and "Best Practices in Securing Application Containers." CSA's Application Container and Microservices Working Group continues the charge laid by NIST to develop additional guidance around best practices in securing Microservices.//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/08/challenges-best-practices-in-securing-application-containers-and-microservices/]] sur le blog de la CSA.
|!Août|!Sources|!Titres et Liens|!Synthèse|
|2019.08.09|CSA|[[CSA Releases "The Six Pillars of DevSecOps" Report|https://cloudsecurityalliance.org/articles/csa-releases-the-six-pillars-of-devsecops-report/]]|Paper identifies areas critical to successful DevSecOps integration within an organization|
|2019.08.09|CSA|[[CSA Releases New Research - Top Threats to Cloud Computing: Egregious Eleven|https://cloudsecurityalliance.org/articles/csa-releases-new-research-top-threats-to-cloud-computing-egregious-eleven/]]|Research shows traditional security issues falling by the wayside while those stemming from senior management decisions of increasing concern|
!"//The Cloud in the Fight Against Cyber-Bullying//"
[>img(150px,auto)[iCSA/J87BT.jpg]]Article de blog publié le 7 août 2019 — Rédigé par le Cybersecurity International Institute (CSI)
<<<
//The CSI Institute (→ [[Cybersecurity International Institute|https://www.csii.gr/]]) is a non-governmental and not-for-profit organization. Our goal is to contribute to the information, education, and, overall practical awareness of citizens in new technologies, online safety, and cybersecurity issues. In this context, we aim to enhance the scientific research in the field of modern technology, with an emphasis on cybercrime and online threats (viruses, etc.).

The antibullying project is an original and innovative action, exclusively established by the CSI Institute. It is, in fact, the first global innovation of its kind as there has been no such action internationally that could impact the community worldwide. The initiative will focus on supporting awareness, education and prevention of bullying and cyber-bullying in all Greek schools as a first implementation step

The project aims to develop a communication window with teens and pre-teens in the whole country, to reduce the dramatic dimensions of bullying and cyberbullying. As many people might know, some of the countless negative effects of bullying and cyberbullying include depression, anxiety, social phobia, loneliness, isolation, panic attacks, difficulty in concentrating and attention, substance use, eating disorders, online grooming, trafficking, tendencies and behaviors of self-injury, and even suicidal intentions.

In the antibullying project, students from every class of schools throughout the country will be elected as (Anti-Bullying) Ambassadors. Their role will be to pass on the knowledge they acquire from the CSI Institute to their environment. They will also report any dangerous activities or behaviors within the school or digital environment to the dedicated digital center that has been set up. In this way, students will receive first-aid psychological assistance and support from our specialized scientists. The target group for this action is students from Greece, ranging in ages from the third grade of primary school to the third grade of senior high school. The aim is to inform, educate, and raise awareness in the educational system of Greece and then expand this operation internationally (starting from Europe and then continue globally).

This action has generated a great deal of interest among many international organizations, and its initially calculated to cost 150,000 euros. This number includes the cost of setting up the whole project (computer systems, digital cloud platforms, and the yearly staff expenses for the experts that will be hired).

This action will be undertaken by any organization or group that shows an interest in supporting its full implementation and function. Once implemented, the minimum cost per year will be approximately 90,000 euros. Additional costs will include: the daily wages of the six specialized scientists, the maintenance of the digital platform and any travels nationally and internationally, where there is increased interest due to multiple cases of bullying.

Our final goal is to have a positive impact internationally and reduce the number of bullying and cyber-bullying incidents, as well as their harmful effects.//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/05/facebook-project-libra-the-good-the-bad-the-ugly-and-why-you-should-care%ef%bb%bf/]] sur le blog de la CSA.
!"//Six Pillars of DevSecOps//"
<<<
[>img(150px,auto)[iCSA/J87PS.png]]//In our current state of cyber security, there has been a large growth of application flaws that bypass the continuing addition of security frameworks to ensure overall health of a project life cycle. Reducing the complexity during development cycles as well as being given the resources to build a trusted environment are key to future success. This is where DevSecOps takes shape. DevSecOps is the integration of continuous security principles, processes, and technology into DevOps culture, practices, and workflows. The Six Pillars of DevSecOps sets forth to introduce concepts that can be utilized and help companies grow with. With use cases to follow by, this paper allows industry professionals to take the concepts and apply them to their own environments.//
<<<
__Périmètre :__
<<<
//This document defines the six focus areas of DevSecOps critical to implementing and integrating DevSecOps into an organization.
The DevSecOps pillars provided in this document are meant to provide a holistic framework that blends the traditionally siloed operations: development, infrastructure operations, and information security, into a cohesive group that facilitates creation of secure software.// [...]
* //Pillar 1 Collective Responsibility//
* //Pillar 2 Collaboration and Integration//
* //Pillar 3 Pragmatic Implementation//
* //Pillar 4 Bridging Compliance and Development//
* //Pillar 5 Automation//
* //Pillar 6 Measure, Monitor, Report and Action//
<<<
__Conclusion :__
<<<
//The CSA DevSecOps Working Group concludes that the focus areas described in this document is able to address weaknesses in secure software development in the context of DevSecOps and will act as a building block for the future dynamic and creation of a properly implemented DevSecOps environment.
Each of the pillars will be addressed in depth in subsequent separate whitepapers.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j87p/|https://CloudSecurityAlliance.fr/go/j87p/]]''
!"//Top Threats to Cloud Computing: Egregious Eleven//"
<<<
[>img(150px,auto)[iCSA/J86PT.jpg]]//The report provides organizations with an up-to-date, expert-informed understanding of cloud security concerns in order to make educated risk-management decisions regarding cloud adoption strategies.//
<<<
__Synthèse :__
<<<
//The Top Threats reports have traditionally aimed to raise awareness of threats, risks and vulnerabilities in the cloud. Such issues are often the result of the shared, on-demand nature of cloud computing.
In this fourth installment, we again surveyed 241 industry experts on security issues in the cloud industry. This year our respondents rated 11 salient threats, risks and vulnerabilities in their cloud environments. The Top Threats Working Group used the survey results along with its expertise to create the final 2019 report.
The latest report highlights the Egregious Eleven (ranked in order of significance per survey results with applicable previous rankings)://
# //Data Breaches//
# //Misconfiguration and Inadequate Change Control//
# //Lack of Cloud Security Architecture and Strategy//
# //Insufficient Identity, Credential, Access and Key Management//
# //Account Hijacking//
# //Insider Threat//
# //Insecure Interfaces and APIs//
# //Weak Control Plane//
# //Metastructure and Applistructure Failures//
# //Limited Cloud Usage Visibility//
# //Abuse and Nefarious Use of Cloud Services//
<<<
__Conclusion :__
<<<
//As cloud business models and security tactics evolve, this report raises awareness of critical security issues such as data breaches, misconfiguration and identity, and access management. Other threats highlight lack-of-control hurdles that users may experience with CSPs, such as limited cloud usage visibility and weak control plane. These issues can lead to data breaches or leaks beyond the traditional landscape, as seen in many past cases.
Considering that user interfaces and APIs are the modern way to consume services, it is concerning that there are still significant challenges when it comes to securing these features.
The cloud - with its complexity - is also the perfect place for attackers to hide. It is also, unfortunately, an ideal launchpad for attacks. Last but not least, insider threats make it more challenging to protect organizations from data loss.
All of these pitfalls require more industry attention and research.
This Top Threats in Cloud Computing report suggests an interesting and somewhat new perspective on cloud security. This new outlook focuses on configuration and authentication, and shifts away from the traditional focus on information security (e.g., vulnerabilities and malware). Regardless, these security issues are a call to action for developing and enhancing cloud security awareness, configuration, and identity management.//
<<<
&rArr; Communiqué de presse → ''[[CloudSecurityAlliance.fr/go/j86p/|https://CloudSecurityAlliance.fr/go/j86p/]]''
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j86b/|https://CloudSecurityAlliance.fr/go/j86b/]]''
!"//Facebook Project Libra - the good, the bad, the ugly and why you should care?//"
[>img(150px,auto)[iCSA/J85BF.jpg]]Article de blog publié le 5 août 2019 — Rédigé par Kurt Seifried, Chief Blockchain Officer, CSA
<<<
//From the Seifried Files
So you've probably heard by now that Facebook will be creating a crypto-currency called "Project Libra" and if you haven't well, now you know.

So first let's cover what is good about this. Facebook has announced Project Libra as a Stablecoin, its value will be pegged to a basket of stable "real world" currencies (I'm guessing something like a mix of USD, Euro and Yen), so speculation won't really be a thing. Lessons from other stablecoin launches have clearly been learned by Facebook, this one will be using OpenSource technology, it will actually be "owned" by the "Libra Foundation" which is headquartered in Switzerland. We already have the typical mix of white papers talking about the Libra blockchain, the on-chain software that will be used to enforce the chain governance, rules, smart contracts and so on. As is typical there's not an actual running production instance, just the test network, and the software hasn't yet been formally audited or put through a formal verification process, but it will be. Essentially Facebook is using every signal possible to show this as a legitimate and trustworthy crypto-currency that can be used for payments.

To be honest the technology and governance structure looks fine, there's nothing really new or significantly different which I think is a good thing, Project Libra is designed to provide a stablecoin that can be used as a payment system, something you don't really need or want a lot of new surprises and excitement in.

So are there any real downsides to Project Libra? Probably the biggest one is that Facebook is pushing this forwards, despite setting up an association with a goal of 100 major participants (companies, banks, NGO's, etc.) this project is still heavily tied to Facebook, and many people have a love-hate relationship with Facebook.

There's nothing really ugly about Libra either, but one aspect I'm curious to see play out is how tradable digital assets sold via Libra will handle pricing discrimination. Many companies would rather sell digital assets (like in game skins) at a discount in developing countries as opposed to not selling anything at all. For digital assets that can be exchanged or traded in game this could present an arbitrage opportunity for end users and secondary markets may develop, and as we've seen companies often hate this, because secondary markets are often lucrative (and frustrating for users, opportunities for fraud abound).

But there is one thing that Facebook brings to the crypto-currency table that almost nobody else can (apart from maybe Linkedin or Google…) which is KYC.

KYC is Know Your Customer, it's literally knowing who the account holder(s) are, their identity, location, address, which jurisdiction they are in and so on. This helps prevent things like identity theft and financial fraud, and also ties into the AML side of crypto-currency regulation. Anti-Money Laundering is exactly what it sounds like, and also ties into terrorist and other criminal funding activities.

Facebook has arguably the world's largest social graph, and the deepest knowledge of many people (many people essentially stream their entire life, and the lives of their families on Facebook). Facebook can easily verify who people are (and in many cases they already have via your phone number and so on) in a way that almost nobody else can. This combined with Facebook's reach (they can simply add Libra capability to their website and mobile client and boom, hundreds of millions of people have access to it instantly) gives them a potential advantage no other crypto-currency has ever had.//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/05/facebook-project-libra-the-good-the-bad-the-ugly-and-why-you-should-care%ef%bb%bf/]] sur le blog de la CSA.
!1 - Les nouveautés CSA de la semaine du 29 juillet au 4 août 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog: ''CCM v3.0.1. Update for AICPA, NIST and FedRAMP Mappings''+++*[»]> <<tiddler [[2019.08.02 - Blog : CCM v3.0.1. Update for AICPA, NIST and FedRAMP Mappings]]>>=== 
* Publication : ''Information Security Management through Reflexive Security''+++*[»]> <<tiddler [[2019.08.01 - Publication : 'Information Security Management through Reflexive Security']]>>=== 
* Blog : ''Quantum Technology Captures Headlines in the Wall Street Journal''+++*[»]> <<tiddler [[2019.08.01 - Blog : 'Quantum Technology Captures Headlines in the Wall Street Journal']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.08.04 - Veille Hebdomadaire]] avec plus de 80 liens dont :
* Piratages et fuites de données : Incident Capital One et analyse de l'origine liée (ou non) à AWS, fuite de bucket AWS en Inde, attaque contre des comptes O365
* Rapports et sondages : Gartner, Netskope, Netwrix, Stackrox, Thycotic
* Pannes : O365, Slack
* Divers : Azure et conformité NIST SP 800-53, la KillChain contre AWS, prévention contre les fuites liées aux buckets S3, CASB
!3 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Août|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.08.04|
|2019.08.04|Les Echos[>img[iCSF/flag_fr.png]]|[[Les régulateurs bancaires américains en alerte sur le cloud|https://www.lesechos.fr/finance-marches/banque-assurances/les-regulateurs-bancaires-americains-en-alerte-sur-le-cloud-1122165]]|Regulations|
|2019.08.04|The Korea Times|[[Concerns growing over AWS cloud security in Korea|http://www.koreatimes.co.kr/www/tech/2019/08/133_273271.html]]|Risks|
|2019.08.04|//Sophos//|[[Seven Best Practices for Securing the Public Cloud|http://www.globalsecuritymag.com/Seven-Best-Practices-for-Securing,20190804,89601.html]]|Best_Practices|
|>|>|>|!2019.08.03|
|2019.08.03|Bleeping Computer|[[Misconfigured JIRA Servers Leak Info on Users and Projects|https://www.bleepingcomputer.com/news/security/misconfigured-jira-servers-leak-info-on-users-and-projects/]]|DataLeak Jira|
|>|>|>|!2019.08.02|
|2019.08.02|CERT-EU|[[Massive breach at Capital One, purportedly due to a cloud misconfiguration|https://media.cert.europa.eu/static/MEMO/2019/TLP-WHITE-CERT-EU-MEMO-190802-1.pdf]]|DataBreach Capital_One|
|2019.08.02|DisruptOps|![[Breaking Attacker Kill Chains in AWS: IAM Roles|https://disruptops.com/breaking-attacker-kill-chains-in-aws-iam-roles/]]|KillChain AWS|
|2019.08.02|DZone|[[CASBs: It's Time To Remove The Broker|https://dzone.com/articles/casbs-its-time-to-remove-the-broker]]|CASB|
|2019.08.02|DevOps.com|![[Top 5 AWS Security Mistakes: Leaky S3 Buckets|https://devops.com/top-5-aws-security-mistakes-leaky-s3-buckets/]]|AWS S3|
|2019.08.02|MSSP Alert|[[40,000 Cloud Container Platforms Left Unsecured|https://www.msspalert.com/cybersecurity-research/40000-cloud-container-platforms-left-unsecured/]]|Misconfigurations|
|2019.08.02|//Gigamon//|[[Securing Beyond Shared Responsibility - Cloud Traffic Visibility|https://blog.gigamon.com/2019/08/02/securing-beyond-shared-responsibility-cloud-traffic-visibility/]]|Shared_Responsibility|
|2019.08.02|//IBM//|[[IBM's CTO, Cloud Platform Services, on "Cloud Paks", Containers, Paas-Bashing and Mainframes|https://www.cbronline.com/qa/bala-rajaraman-cto-ibm-cloud-platform-services]]|Misc|
|2019.08.02|//Akamai//|[[Security Fundamentals Are Key To Successful Cloud Migration|https://blogs.akamai.com/2019/08/security-fundamentals-are-key-to-successful-cloud-migration.html]]|Zero_Trust|
|>|>|>|!2019.08.01|
|2019.08.01|Les Echos[>img[iCSF/flag_fr.png]]|[[Une page se tourne pour le cloud souverain français|https://www.lesechos.fr/tech-medias/hightech/une-page-se-tourne-pour-le-cloud-souverain-francais-1118112]]|Sovereign_Cloud Cloudwatt|
|2019.08.01|Wall Street Journal|[[Fed Examined Amazon's Cloud in New Scrutiny for Tech|https://www.wsj.com/articles/fed-examined-amazons-cloud-in-new-scrutiny-for-tech-11564693812]]|AWS|
|2019.08.01|DZone|[[Your Cloud Application Security Checklist|https://dzone.com/articles/your-cloud-application-security-checklist]]|Misc|
|2019.08.01|DataBreaches.net|[[A misconfigured AWS bucket exposed personal and counseling logs of almost 300,000 Indian employees|https://www.databreaches.net/a-misconfigured-aws-bucket-exposed-personal-and-counseling-logs-of-almost-300000-indian-employees/]]|DataBreaches|
|2019.08.01|isBuzzNews|[[Practicing Safe Containerisation|https://www.informationsecuritybuzz.com/articles/practicing-safe-containerisation/]]|Containers|
|2019.08.01|FCW|[[Nuclear weapons security agency moving apps to cloud|https://fcw.com/articles/2019/08/01/nnsa-cloud-rockwell.aspx]]|Misc|
|2019.08.01|//Netwrix//|[[Lack of Budgets for Cloud Security Initiatives Slows Down Cloud Adoption for Government|https://vmblog.com/archive/2019/08/01/netwrix-survey-lack-of-budgets-for-cloud-security-initiatives-slows-down-cloud-adoption-for-government.aspx]]|Report Netwrix|
|2019.08.01|//Netwrix//| → [[2019 Netwrix Cloud Data Security Report|https://www.netwrix.com/2019cloudsecurityreport.html]]|Report Netwrix|
|2019.08.01|//Netwrix//[>img[iCSF/flag_fr.png]]| → [[Les budgets de sécurité du cloud insuffisants ralentissent son adoption dans le secteur public|https://cyberexperts.tech/les-budgets-de-securite-du-cloud-insuffisants-ralentissent-son-adoption-dans-le-secteur-public/]]|Report Netwrix|
|2019.08.01|//Azure//|![[New Azure Blueprint simplifies compliance with NIST SP 800-53|https://azure.microsoft.com/en-us/blog/new-azure-blueprint-simplifies-compliance-with-nist-sp-800-53/]]|
|2019.08.01|//Azure//|[[Introducing Azure Dedicated Host|https://azure.microsoft.com/en-us/blog/introducing-azure-dedicated-host/]] ([[site dédié "ADH"|https://aka.ms/ADHWebsite]]=|Azure Isolation|
|2019.08.01|//Thycotic//|[[Security as a Service (Saas) on the Rise - 2019 Global Research Report|https://thycotic.com/resources/security-as-a-service-global-research-report/]]|Report Thycotic|
|2019.08.02|InfoSecurity Mag| → [[70% of Orgs Will Use Security-as-a-Service by 2021|https://www.infosecurity-magazine.com/news/orgs-securityasaservice-by-2021/]]|Report Thycotic|
|2019.08.01|//Managed Methods//|[[CASBs: Is It Time To Remove The "Broker" From Cloud Access Security Broker?|https://managedmethods.com/blog/casbs-time-to-remove-the-broker/]]|CASB|
|2019.08.01|//Security Intelligence//|[[The Secret to a Secure Multicloud Enterprise Is Open Source|https://securityintelligence.com/posts/the-secret-to-a-secure-multicloud-enterprise-is-open-source/]]|MultiCloud|
|2019.08.01|//Cruise//|[[Secrets Management in a Cloud Agnostic World|https://medium.com/cruise/secrets-management-3a7c47fe81b]]|Secret_Management|
|2019.08.01|//CompliantCloud//|[[The Crossover of Data Integrity and Data Privacy in the Cloud|https://compliantcloud.com/data-integrity-data-privacy-cloud-life-science/]]|Integrity Privacy|
|2019.08.01|//Aporeto//|[[Hardening Cloud Security|https://www.aporeto.com/blog/hardening-cloud-security/]]|Hardening|
|2019.08.01|//Aqua//|[[Kubernetes Pod Escape Using Log Mounts|https://blog.aquasec.com/kubernetes-security-pod-escape-log-mounts]]|Kubernetes Logging|
|2019.08.01|//Akamai//|[[4 Critical Elements Your Next Security Solution Must Have|https://blogs.akamai.com/2019/08/4-critical-elements-your-next-security-solution-must-have.html]]|Misc|
|>|>|>|!|
|>|>|>||
|!Juillet|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.07.31|
|2019.07.31|ZDnet[>img[iCSF/flag_fr.png]]|[[Cloudwatt : arrêt du service en février prochain|https://www.zdnet.fr/actualites/cloudwatt-arret-du-service-en-fevrier-prochain-39888593.htm]]|Sovereign_Cloud Cloudwatt|
|2019.07.31|Rainbowtabl.es|[[Honda Motor Company leaks database with 134 million rows of employee computer data|https://rainbowtabl.es/2019/07/31/honda-motor-company-leak/]]|DataLeak ElasticSearch|
|2019.07.31|Bleeping Computer| → [[Unsecured Database Exposes Security Risks in Honda's Network|https://www.bleepingcomputer.com/news/security/unsecured-database-exposes-security-risks-in-hondas-network/]]|DataLeak ElasticSearch|
|2019.07.31|Dark Reading|[[Google Cloud Debuts New Security Capabilities|https://www.darkreading.com/cloud/google-cloud-debuts-new-security-capabilities/d/d-id/1335405]]|GCP|
|2019.07.31|CSO Online|[[Is the cloud lulling us into security complacency?|https://www.csoonline.com/article/3412006/is-the-cloud-lulling-us-into-security-complacency.html]]|Governance|
|2019.07.31|DZone|[[Cloud-Native Best Business Practices (Part 3) - Open Source|https://dzone.com/articles/cloud-native-best-business-practices-part-3-open-s]] (3/7)|Best_Practices|
|2019.07.31|ZDnet|[[Brazilian firms struggle with cloud security immaturity|https://www.zdnet.com/article/brazilian-firms-struggle-with-cloud-security-immaturity/]]|Report Symantec|
|2019.07.31|//Google//|[[Titan Security Keys: now available in Japan, Canada, France, and the UK|https://gsuiteupdates.googleblog.com/2019/07/titan-security-key-expansion.html]]|GCP Authentication|
|2019.07.31|//Google//|[[Defend high-risk users with the Advanced Protection Program for enterprise beta|https://gsuiteupdates.googleblog.com/2019/07/advanced-protection-program-enterprise.html]]|GCP|
|2019.07.31|Dark Reading| → [[Google Cloud Debuts New Security Capabilities|https://www.darkreading.com/cloud/google-cloud-debuts-new-security-capabilities/d/d-id/1335405]]|GCP|
|2019.07.31|//Rapid7//|[[Do You Have Containers in Your Environment? Using Container Discovery to Be Sure|https://blog.rapid7.com/2019/07/31/do-you-have-containers-in-your-environment-using-container-discovery-to-be-sure/]]|Containers Discovery|
|2019.07.31|//Blissfully//|[[SaaS Vendor Renewal Process: A Checklist for IT|https://www.blissfully.com/blog/saas-vendor-renewal-process-checklist/]]|SaaS Contracting|
|2019.07.31|//AtScale//|[[Orchestrating security policies across your hybrid cloud with intelligent data virtualization|https://www.helpnetsecurity.com/2019/07/31/intelligent-data-virtualization/]]|Misc|
|2019.07.31|//IbexLabs//|[[Fault Tolerance And Redundancy For Cloud Computing|https://www.ibexlabs.com/fault-tolerance-and-redundancy-for-cloud-computing/]]|Redundancy|
|2019.07.31|//Detectify//|[[Bypassing Cloudflare WAF with the origin server IP address|https://blog.detectify.com/2019/07/31/bypassing-cloudflare-waf-with-the-origin-server-ip-address/]]|Firewall|
|>|>|>|!2019.07.30|
|2019.07.30|Bleeping Computer|[[Outlook Is Down, Users Are Experiencing Sign-in Failures|https://www.bleepingcomputer.com/news/technology/outlook-is-down-users-are-experiencing-sign-in-failures/]]|Outage O365|
|2019.07.30|CSO Online|[[What is a CASB? What you need to know before you buy|https://www.csoonline.com/article/3104981/what-is-a-cloud-access-security-broker-and-why-do-i-need-one.html]]|CASB|
|2019.07.30|SecurityWeek|[[Microsoft Makes Azure Security Center for IoT Generally Available|https://www.securityweek.com/microsoft-makes-azure-security-center-iot-generally-available]]|Azure IoT|
|2019.07.30|Numerama[>img[iCSF/flag_fr.png]]|[[Paris sait les risques du Cloud Act, mais ne peut pas dissuader les Français d'aller sur Google ou Facebook|https://www.numerama.com/politique/537429-paris-sait-les-risques-du-cloud-act-mais-ne-peut-pas-dissuader-les-francais-daller-sur-google-ou-facebook.html]]|CLOUD_Act|
|2019.07.30|CompareTheCloud|[[Changing from network access to application access|https://www.comparethecloud.net/articles/changing-from-network-access-to-application-access/]]|Access_Controls|
|2019.07.30|CSO Online|[[6 lessons from Venmo's lax approach to API security|https://www.csoonline.com/article/3410044/6-lessons-from-venmos-lax-approach-to-api-security.html]]|Data_Leak APIs|
|2019.07.30|MSSP Alert|[[AWS Cloud Cybersecurity: Customer Errors Threaten Amazon's Credibility|
|2019.07.31|//Digital Shadows//|[[The Account Takeover Kill Chain: A Five Step Analysis|https://www.digitalshadows.com/blog-and-research/the-account-takeover-kill-chain-a-five-step-analysis/]]|KillChain|
|2019.07.30|//Lastline//|[[8 IaaS Cloud Security Challenges You Should Be Aware Of|https://www.lastline.com/blog/8-iaas-cloud-security-challenges-you-should-be-aware-of/]]|IaaS Risks|
|2019.07.30|//Cyware//|[[Community Psychiatric Clinic responds to incident involving unauthorized access to Office 365 accounts|https://cyware.com/news/community-psychiatric-clinic-responds-to-incident-involving-unauthorized-access-to-office-365-accounts-2a548992]]|O365 Incident|
|2019.07.30|//Stackrox//|[[Kubernetes and Container Security and Adoption Trends|https://www.stackrox.com/kubernetes-adoption-and-security-trends-and-market-share-for-containers/]]|Report Containers|
|2019.07.30|VMblog| → [[StackRox Report Reveals Security Concerns Have Increased Despite Rapid Adoption of Containers and Kubernetes|https://vmblog.com/archive/2019/07/30/stackrox-report-reveals-security-concerns-have-increased-despite-rapid-adoption-of-containers-and-kubernetes.aspx]]|Report Containers|
|2019.07.30|SecurityWeek| → [[Security a Top Concern as Containerization Gathers Pace|https://www.securityweek.com/security-top-concern-containerization-gathers-pace]]|Report Containers|
|2019.07.30|BetaNews| → [[Organizations struggle with container security|https://betanews.com/2019/07/30/container-security-struggle/]]|Report Containers|
|2019.09.03|//Tripwire//| → [[Survey Reveals Kubernetes Usage Skyrocketing, but Security Concerns Remain|https://www.tripwire.com/state-of-security/devops/kubernetes-usage-skyrocketing-security-concerns-remain/]]|Report Containers|
|2019.07.31|//Netskope//|[[Netskope Cloud Report - August 2019|https://resources.netskope.com/cloud-reports/netskope-cloud-report-august-2019]]|Report Netskope|
|2019.08.01|Solutions Review| → [[Cloud Services Accounts for 85% of Enterprise Web Traffic|https://solutionsreview.com/cloud-platforms/cloud-services-accounts-for-85-of-enterprise-web-traffic/]]|Report Netskope|
|2019.08.01|BetaNews| → [[85 percent of enterprise web traffic is cloud services|https://betanews.com/2019/08/01/enterprise-web-traffic-cloud/]]|Report Netskope|
|2019.07.30|//Radware//|[[Security Considerations for Cloud Hosted Services|https://blog.radware.com/security/cloudsecurity/2019/07/security-considerations-for-cloud-hosted-services/]]|Hosting|
|2019.07.30|//TAG Cyber//|[[More Benefits, Risks, and Insurance Issues in the Cloud|https://threatvector.cylance.com/en_us/home/more-benefits-risks-and-insurance-issues-in-the-cloud.html]]|Risks Insurance|
|2019.07.30|//Google//|[[3 questions to ask before moving your organization's content to the cloud|https://cloud.google.com/blog/topics/perspectives/3-questions-to-ask-before-moving-your-organizations-content-to-the-cloud]]|Misc|
|2019.07.30|//DivvyCloud//|[[PERSPECTIVE: Automation Is the Antidote for Government Agencies Plagued by Cyberattacks|https://www.hstoday.us/subject-matter-areas/cybersecurity/perspective-automation-is-the-antidote-for-government-agencies-plagued-by-cyberattacks/]]|Automation|
|>|>|>|!2019.07.29|
|2019.07.29|Capital One|[[Capital One Announces Data Security Incident|https://press.capitalone.com/phoenix.zhtml]]|DataBreach Capital_One|
|2019.07.29|Washington Post| → [[Capital One looked to the cloud for security. But its own firewall couldn't stop a hacker.|https://www.washingtonpost.com/technology/2019/07/30/capital-one-looked-cloud-security-its-own-firewall-couldnt-stop-hacker/]]|DataBreach Capital_One|
|2019.07.29|The New York Times| → [[Capital One Data Breach Compromises Data of Over 100 Million|https://www.nytimes.com/2019/07/29/business/capital-one-data-breach-hacked.html]]|DataBreach Capital_One|
|2019.07.29|Bloomberg| → [[Capital One Says Breach Hit 100 Million Individuals in U.S.|https://www.bloomberg.com/news/articles/2019-07-29/capital-one-data-systems-breached-by-seattle-woman-u-s-says]]|DataBreach Capital_One|
|2019.07.29|MSSP Alert| → [[Capital One Data Breach Details: 10 Things to Know|https://www.msspalert.com/cybersecurity-breaches-and-attacks/capital-one-details/]]|DataBreach Capital_One|
|2019.07.30|Krebs On Security| → [[Capital One Data Theft Impacts 106M People|https://krebsonsecurity.com/2019/07/capital-one-data-theft-impacts-106m-people/]]|DataBreach Capital_One|
|2019.07.30|//Threatpost//| → [[Former AWS Engineer Arrested as Capital One Admits Massive Data Breach|https://threatpost.com/aws-arrest-data-breach-capital-one/146758/]]|DataBreach Capital_One|
|2019.07.30|MSSP Alert| → [[AWS Cloud Cybersecurity: Customer Errors Threaten Amazon's Credibility|https://www.msspalert.com/cybersecurity-news/aws-cloud-cybersecurity-configuration-errors/]]|DataBreach Capital_One|
|2019.07.30|//Lacework//| → [[How Capital One Illustrates the Need for Cloud Configuration Visibility|https://www.lacework.com/capital-one-cloud-configuration-visibility/]]|DataBreach Capital_One|
|2019.07.30|CIO Dive| → [[5 things to know about Capital One's breach|https://www.ciodive.com/news/5-things-to-know-about-capital-ones-breach/559909/]]|DataBreach Capital_One|
|2019.07.30|J Cole Morrison| → [[The Technical Side of the Capital One AWS Security Breach|https://start.jcolemorrison.com/the-technical-side-of-the-capital-one-aws-security-breach/]]|DataBreach Capital_One|
|2019.07.30|Laureen Weinstein| → [[Another Breach: What Capital One Could Have Learned from Google's "BeyondCorp"|https://lauren.vortex.com/2019/07/30/another-breach-what-capital-one-could-have-learned-from-googles-beyondcorp]]|DataBreach Capital_One|
|2019.07.30|Evan Johnson| → [[Preventing The Capital One Breach|https://ejj.io/blog/capital-one]]|DataBreach Capital_One|
|2019.07.31|//Digital Shadows//| → [[Capital One Breach: What we know and what you can do|https://www.digitalshadows.com/blog-and-research/capital-one-breach-what-we-know-and-what-you-can-do/]]|DataBreach Capital_One|
|2019.07.31|//Duo Security//| → [[Capital One Breach Does Not Mean the Cloud is Insecure|https://duo.com/decipher/capital-one-breach-does-not-mean-the-cloud-is-insecure]]|DataBreach Capital_One|
|2019.08.01|The Last Watchdog| → [[ROUNDTABLE: Huge Capital One breach shows too little is being done to preserve data privacyThe Last Watchdog|https://www.lastwatchdog.com/roundtable-huge-capital-one-breach-shows-too-little-is-being-done-to-preserve-data-privacy/]]|DataBreach Capital_One|
|2019.08.01|//Fugue//|! → [[A Technical Analysis of the Capital One Cloud Misconfiguration Breach|https://www.fugue.co/blog/a-technical-analysis-of-the-capital-one-cloud-misconfiguration-breach]]|DataBreach Capital_One|
|2019.08.02|Dark Reading| → [[Capital One: What We Should Learn This Time|https://www.darkreading.com/cloud/capital-one-what-we-should-learn-this-time/d/d-id/1335426]]|DataBreach Capital_One|
|2019.08.02|Krebs On Security| → [[What We Can Learn from the Capital One Hack|https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/]]|DataBreach Capital_One|
|2019.07.29|Bleeping Computer|[[Slack Experiencing Large-Scale Outage Caused by Messaging Issue|https://www.bleepingcomputer.com/news/technology/slack-experiencing-large-scale-outage-caused-by-messaging-issue/]]|Outage Slack|
|2019.07.29|DZone|![[Did I Just See Google Cloud Go Back in Time?|https://dzone.com/articles/did-i-just-see-google-cloud-go-back-in-time]]|History|
|2019.07.29|DZone|[[Step-by-Step Guide: Establishing Container Networking|https://dzone.com/articles/step-by-step-guide-establishing-container-networki]]|Containers|
|2019.07.29|Bleeping Computer|[[Microsoft Adds IoT Device Protection to Azure Security Center|https://www.bleepingcomputer.com/news/microsoft/microsoft-adds-iot-device-protection-to-azure-security-center/]]|Azure IoT|
|2019.07.29|IoT for all|[[Cloud-Native Environments: A Challenge for Traditional Cybersecurity Practices|https://www.iotforall.com/cloud-native-environments-challenge-traditional-cybersecurity-practices/]]|Misc|
|2019.07.29|CISO Mag|[[Debunking five myths in cloud security|https://www.cisomag.com/debunking-five-myths-in-cloud-security/]]|Misc|
|2019.07.29|The Register|[[Microsoft preps to purge its cloud access security broker of shonky crypto protocols TLS 1.0, 1.1|https://www.theregister.co.uk/2019/07/29/tls_microsoft_cloud_security/]]|Cryptography|
|2019.07.29|The Register|[[We need you for a multi-cloud sanity check: Which providers do you use and need, and how do you choose them?|https://www.theregister.co.uk/2019/07/29/cloud_provider_survey/]]|Survey|
|2019.07.29|HelpNet Security|[[Cloud adoption and security are not mutually exclusive|https://www.helpnetsecurity.com/2019/07/29/cloud-adoption-and-security/]]|Misc|
|2019.07.29|Container Journal|[[Cluster Monitoring With Prometheus Operator|https://containerjournal.com/2019/07/29/cluster-monitoring-with-prometheus-operator/]]|Kubernetes|
|2019.07.29|Security Scoreboard|[[Benefits of Continuous Compliance Monitoring in the Cloud|https://securityscorecard.com/blog/benefits-continuous-compliance-monitoring-in-cloud]]|Compliance Monitoring|
|2019.07.29|CyberSecurity Hub|[[Cloud Security Market Report: Exploring The Right Enterprise Strategy|https://www.cshub.com/cloud/reports/cloud-security-market-report-exploring-the-right-enterprise-strategy]]|Report|
|2019.07.29|Technology Decisions|[[Cloud customers still making basic security mistakes|https://www.technologydecisions.com.au/content/cloud-and-virtualisation/article/cloud-customers-still-making-basic-security-mistakes-1251148303]]|Best_Practices|
|2019.07.29|CBR Online|[[What Is DevOps Security - and Does it Drive Secure Deployments?|https://www.cbronline.com/feature/devops-security]]|DevSecOps|
|2019.07.29|CircleID|[[Gartner Says Worldwide IaaS Public Cloud Services Market Grew 31.3% in 2018|http://www.circleid.com/posts/20190729_worldwide_iaas_public_cloud_services_market_in_2018/]]|IaaS|
|2019.07.29|//Threatpost//|[[Cloud Security Concerns Loom for 93% of Businesses Adopting Apps and BYOD|https://threatpost.com/cloud-security-concerns-loom-for-93-of-businesses-adopting-apps-and-byod/146739/]]|BYOD|
|2019.07.29|//Cloud Passage//|[[Why IaaS requires cloud security automation|https://blog.cloudpassage.com/2019/07/29/iaas-requires-cloud-security-automation/]]|IaaS Automation|
|2019.07.29|//Security Intelligence//|![[Cloud Provider Relationships Don't Last, So Protect Your Data With an Exit Plan|https://securityintelligence.com/posts/cloud-provider-relationships-dont-last-so-protect-your-data-with-an-exit-plan/]]|Reversibility|
|2019.07.29|//PaloAlto Networks//|[[Advantages of Cloud-Delivered Security for U.S. Govt Agencies|https://blog.paloaltonetworks.com/2019/07/cloud-delivered-security-benefits-govt-agencies/]]|Government|
|2019.07.29|//Imperva//|[[Enabling Faster DDoS Mitigation for Cloud Assets|https://www.imperva.com/blog/enabling-faster-ddos-mitigation-for-cloud-assets/]]|DDoS Mitigation|
|2019.07.29|Techrepublic|[[Is homomorphic encryption ready to deliver confidential cloud computing to enterprises?|https://www.techrepublic.com/article/is-homomorphic-encryption-ready-to-deliver-confidential-cloud-computing-to-enterprises/]]|Encryption Homomorphic|
|2019.07.29|//Azure//|[[Announcing general availability for the Azure Security Center for IoT|https://azure.microsoft.com/en-us/blog/announcing-general-availability-for-the-azure-security-center-for-iot/]]|Azure IoT|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Août 2019]]>>
!"//CCM v3.0.1-080319//"
[>img(150px,auto)[iCSA/J83PC.jpg]]__"''CCM v3.0.1 version du 3 août 2019''"__
<<<
//The CCM, the only meta-framework of cloud-specific security controls, mapped to leading standards, best practices and regulations. CCM provides organizations with the needed structure, detail and clarity relating to information security tailored to cloud computing. CCM is currently considered a de-facto standard for cloud security assurance and compliance.//
<<<
&rArr; Téléchargement (après inscription, mais ''indisponible pour le moment'') → ''[[CloudSecurityAlliance.fr/go/j83c/|https://CloudSecurityAlliance.fr/go/j83c/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//CSA CCM v3.0.1 Addendum for AICPA, NIST and FedRAMP Mappings//"
[>img(150px,auto)[iCSA/J83PC.jpg]]__"''CSA CCM v3.0.1 Addendum - AICPA TSC 2017''"__
<<<
//This document is an addendum to the CCM V3.0.1 that contain controls mapping between the CSA CCM and the AICPA TSC 2017. The document aims to help AICPA TSC 2017 compliant organizations meet CCM requirements. This is achieved by identifying compliance gaps in AICPA TSC 2017 in relation to the CCM. This document contains the following information:
* Controls Mapping
* Gap Analysis
* Gap Identification (i.e. Partial, Full or No Gap)
//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j83a/|https://CloudSecurityAlliance.fr/go/j83a/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//CSA CCM v3.0.1 Addendum - NIST 800-53 Rev 4 Moderate//"
[>img(150px,auto)[iCSA/J83PC.jpg]]__"''CSA CCM v3.0.1 Addendum - NIST 800-53 Rev 4 Moderate''"__
<<<
//This document is an addendum to the CCM V3.0.1 that contain controls mapping between the CSA CCM and the NIST 800-53 R4 Moderate Baseline. The document aims to help NIST 800-53 R4 Moderate compliant organizations meet CCM requirements. This is achieved by identifying compliance gaps in NIST 800-53 in relation to the CCM. This document contains the following information:
* Controls Mapping
* Gap Analysis
* Gap Identification (i.e. Partial, Full or No Gap)
//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j83n/|https://CloudSecurityAlliance.fr/go/j83n/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//CCM v3.0.1 Addendum - FedRAMP Moderate//"
[>img(150px,auto)[iCSA/J83PC.jpg]]__"''CCM v3.0.1 Addendum - FedRAMP Moderate''"__
<<<
//This document is an addendum to the CCM V3.0.1 that contain controls mapping between the CSA CCM and the FedRAMP R4 Moderate Baseline. The document aims to help FedRAMP compliant organizations meet CCM requirements. This is achieved by identifying compliance gaps in FedRAMP in relation to the CCM. This document contains the following information:
* Controls Mapping
* Gap Analysis
* Gap Identification (i.e. Partial, Full or No Gap)
//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j83f/|https://CloudSecurityAlliance.fr/go/j83f/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//CCM v3.0.1. Update for AICPA, NIST and FedRAMP Mappings//"
[>img(150px,auto)[iCSA/J82BC.jpg]]Article de blog publié le 2 août 2019 — Rédigé par Victor Chin et Lefteris Skoutaris, Research Analysts, CSA
<<<
//The CSA Cloud Controls Matrix (CCM) Working Group is glad to announce the new update to the CCM v3.0.1. This minor update will incorporate the following mappings:
* Association of International Certified Professional Accountants (AICPA) Trust Services Criteria (TSC) 2017
* National Institute of Standards and Technology (NIST) 800-53 R4 Moderate
* Federal Risk Authorization and Management Program (FedRAMP) Moderate

A total of four documents will be released. The updated CCM (CCM v3.0.1-03-08-2019) will be released to replace the outdated CCM v3.0.1-12-11-2017. Additionally, three addendums will be released for AICPA TSC 2017, NIST 800-53 R4 Moderate and FedRAMP moderate, separately. The addendums will contain gap analyses and also control mappings. We hope that organizations will find these documents helpful in bridging compliance gaps between the CCM, AICPA TSC 2017, FedRAMP and NIST 800-53 R4 Moderate.
With the release of this update the CCM Working Group will be concluding all CCM v3 work and refocusing our efforts on CCM v4.

The upgrade of CCM v3 to the next version 4 has been made imperative due to the evolution of the cloud security standards, the need for more efficient auditability of the CCM controls and integration into CCM of the security requirements deriving from the new cloud technologies introduced.
In this context, a CCM task force has already been established to take on this challenge and drive CCM v4 development. The CCM v4 working group is comprised of CSA's community volunteers comprised of industry's leading experts in the domain of cloud computing and security. This endeavor is supported and supervised by the [[CCM co-chairs and strategic advisors|https://cloudsecurityalliance.org/research/working-groups/cloud-controls-matrix]] who will ensure that the CCM v4 vision requirements and development plan are successfully implemented.
Some of the core objectives that drive CCM v4 development include:
* Improving the auditability of the controls
* Providing additional implementation and assessment guidance to organizations
* Improve interoperability and compatibility with other standards
* Ensuring coverage of requirements deriving from new cloud technologies (e.g., microservices, containers) and emerging technologies (e.g., IoT)
//[...]
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/02/ccm-v3-0-1-update-for-aicpa-nist-and-fedramp-mappings/]] sur le blog de la CSA
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j82m/|https://CloudSecurityAlliance.fr/go/j82m/]]'' (format XLSX)
!"//Quantum Technology Captures Headlines in the Wall Street Journal//"
[>img(150px,auto)[iCSA/J81BQ.jpg]]Article de blog publié le 1^^er^^ août 2019 — Rédigé par le groupe de travail "Quantum-Safe Security"
<<<
//Last month, we celebrated the 50th anniversary of the Apollo 11 moon landing. Apollo, which captured the imagination of the whole world, epitomizes the necessity for government involvement in long term, big science projects. What started as a fierce race between the USA and the USSR at the apex of the cold war ended up as a peaceful mission, "one giant leap for mankind".

This "Leap" was just one of many steps that lead to the US, Russia, Japan, Europe and Canada sharing the International Space Station for further space exploration. The parallel with the quantum computer, which recently made headlines in the Wall Street Journal, is striking gauntlet to be picked up. A foreign power, in this case China, developed advanced quantum technologies passing its western counterparts and warrants a competitive response. Here again, the US policymakers rise to the challenge and call for a significant investment in quantum technologies (as presented in the WSJ article: [[In a White House Summit on Quantum Technology, Experts Map Next Steps|https://CloudSecurityAlliance.fr/go/j81q/]]).

Quantum technologies may not capture the imagination of so many star-gazing children as space. However, show them a golden "chandelier" of a quantum computer, tell them that it operates at temperatures colder than space, explain that it can do more optimization calculations than all classical computers combined, and we might get some converts. We will need these engineers, developers and professions we have not yet thought of to get the full and profound impacts that are likely with quantum computers. If history is any guide, the currently expected applications in pharmaceuticals, finance and transportation mentioned in the WSJ are only a small portion of the real potential. Just these fields will require education on the quantum technologies at a broad level, as called for by the bipartisan participants to the White House Summit on Quantum Technologies. In addition, the threat of the quantum computer on our existing cybersecurity infrastructure (again reported in the WSJ: [[The Day When Computers Can Break All Encryption Is Coming|https://CloudSecurityAlliance.fr/go/j81b/]]), is real today. Sensitive digital data can already be recorded today and decrypted once a powerful-enough quantum computer is available.

This brings us back to the cold war space race, now with many potential players shielded in the obscurity of cyberspace. Let's hope that, as with Apollo, the end result will be improvement for humankind. The international effort, led by the National Institute of Standards and Technology (NIST), to develop new quantum-resistant algorithms, as well as the development of quantum technologies, such as quantum random number generation and quantum-key distribution (QKD), to counter the very threat of the quantum computer, are steps in the right direction.

CSA's quantum-safe security working group has produced several research papers addressing many aspects of quantum-safe security that were discussed in both of these articles. These documents can help enterprises to better understand the quantum threat and steps they can start taking to address this coming threat.//
[...]
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/30/organizations-must-realign-to-face-new-cloud-realities/]] sur le blog de la CSA
!"//Information Security Management through Reflexive Security//"
<<<
[>img(150px,auto)[iCSA/J81PI.png]]//This document defines "Reflexive Security" as a new security management approach that is built upon the interrelationships between security, development and operations necessary for protecting the security stance and the deliverables of an organization.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j81r/|https://CloudSecurityAlliance.fr/go/j81r/]]''






!"//It's Time for Security Leadership to Embrace the Cloud-First Future//"
[>img(100px,auto)[iCSA/J89BA.jpg]]^^Bien que publié le 9 août 2019 sur le blog de la CSA, cet article l'a déjà été il y a 1 mois, le 1er août 2019 sur le site de la société Fugue.
Il faisait partie des articles déjà mentionnés dans notre [[veille datée du 4 août|2019.08.04 - Veille Hebdomadaire]] et signalé comme "à lire".
A noter que si le fait que l'article ait déjà été publié est enfin mentioné, le lien fourni est erroné...
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/09/a-technical-analysis-of-the-capital-one-cloud-misconfiguration-breach/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.fugue.co/blog/a-technical-analysis-of-the-capital-one-cloud-misconfiguration-breach]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201907>>
<<tiddler fAll2Tabs10 with: VeilleM","_201907>>
<<tiddler fAll2LiTabs with: NewsL","201907>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Juillet 2019]]>>
|!Juillet|!Sources|!Titres et Liens|!Keywords|
|>|>|>| Aucune alerte |
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Juillet 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Juillet 2019]]>><<tiddler fAll2LiTabs with: Actu","201907>>
<<tiddler fAll2LiTabs with: Blog","201907>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Juillet 2019]]>>
<<tiddler fAll2LiTabs with: Publ","201907>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Juillet 2019]]>>
!"//Use Cases for Blockchain Beyond Cryptocurrency//"
[>img(150px,auto)[iCSA/J7VBU.jpg]]Article de blog publié le 24 juillet, retiré le 25 juillet, puis publié définitivement le 31 juillet 2019
<<<
[<img(150px,auto)[iCSA/J7OBU.jpg]]//CSA's newest white paper, Documentation of Relevant Distributed Ledger Technology and Blockchain Use Cases v2 is a continuation of the efforts made in v1. The purpose of this publication is to describe relevant use cases beyond cryptocurrency for the application of these technologies.

In the process of outlining several use cases across discrete economic application sectors, we covered multiple industry verticals, as well as some use cases which cover multiple verticals simultaneously. For this document, we considered a use case as relevant when it provides the potential for any of the following:
* disruption of existing business models or processes;
* strong benefits for an organization, such as financial, improvement in speed of transactions, auditability, etc.;
* large and widespread application; and
* concepts that can be applied in real-world scenarios.

From concept to the production environment, we also identified six separate stages of maturity to get a better assessment of how much work has been done within the scope and how much more work remains to be done.
# Concept
# Proof of concept
# Prototype
# Pilot
# Pilot production
# Production
Some of the industry verticals which we identified are finance, supply chain, media/entertainment, and insurance, all of which are ripe for disruption from a technological point of view.
The document also clearly identified the expected benefits from the adoption of DLTs/blockchain in these use cases, type of DLT, use of private vs public blockchain, infrastructure provider-CSP and the type of services (IaaS, PaaS, SaaS). Identification of some other key features in the use case implementations such as Smart Contracts and Distributed Databases have also been outlined.

The working group hopes this document will be a valuable reference to all key stakeholders in the blockchain/DLT ecosystem, as well as contribute to its maturity.//
<<<
[img(25%,1px)[iCSF/BluePixel.gif]]
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/31/use-cases-for-blockchain-beyond-cryptocurrency/]] sur le blog de la CSA. /% 25 -> 31 %/
!"//Documentation of Relevant Distributed Ledger Technology and Blockchain Use Cases v2//"
<<<
[>img(150px,auto)[iCSA/J7OBU.jpg]]//Thanks to the rise in popularity of Bitcoin cryptocurrency, the innovative technologies of Blockchain and other systems of distributed ledger technology (DLT) have proven their ability to increase security of data during transactions and provide immutable long-term data storage. This document provides several use cases for this DLT technology outside of cryptocurrencies.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j7vb/|https://CloudSecurityAlliance.fr/go/j7vb/]]''



!"//Organizations Must Realign to Face New Cloud Realities//"
[>img(150px,auto)[iCSA/J7UBO.jpg]]Article de blog publié le 30 juillet 2019 — Rédigé par Jim Reavis, Co-founder and Chief Executive Officer, CSA
<<<
//While cloud adoption is moving fast, many enterprises still underestimate the scale and complexity of cloud threats

Technology advancements often present benefits to humanity while simultaneously opening up new fronts in the on-going and increasingly complex cyber security battle. We are now at that critical juncture when it comes to the cloud: While the compute model has inherent security advantages when properly deployed, the reality is that any fast-growth platform is bound to see a proportionate increase in incidents and exposure.

The Cloud Security Alliance (CSA) is a global not-for-profit organization that was launched 10 years ago as a broad coalition to create a trusted cloud ecosystem. A decade later, cloud adoption is pervasive to the point of becoming the default IT system worldwide. As the ecosystem has evolved, so have the complexity and scale of cyber security attacks. That shift challenges the status quo, mounting pressure on organizations to understand essential technology trends, the changing threat landscape and our shared responsibility to rapidly address the resultant issues.

> {{{ A decade later, cloud adoption is pervasive to the point of becoming the default IT system worldwide. As the ecosystem has evolved, so have the complexity and scale of cyber security attacks. }}}

There are real concerns that organizations have not adequately realigned for the cloud compute age and in some cases, are failing to reinvent their cyber defense strategies. Symantec's inaugural Cloud Security Threat Report (CSTR) is a landmark report that shines a light on the current challenges and provides a useful roadmap that can help organizations improve and mature their cloud security strategy. The report articulates the most pressing cloud security issues of today, clarifies the areas that should be prioritized to improve an enterprise security posture, and offers a reality check on the state of cloud deployment.
Cloud in the Fast Lane

What the CSTR reveals and the CSA can confirm is that cloud adoption is moving too fast for enterprises, which are struggling with increasing complexity and loss of control. According to the Symantec CSTR, over half (54%) of respondents agree that their organization's cloud security maturity is not keeping pace with the rapid expansion of new cloud apps.

The report also revealed that enterprises underestimate the scale and complexity of cloud threats. For example, the CSTR found that most commonly investigated incidents included garden variety data breaches, DDOS attacks and cloud malware injections. However, Symantec internal data shows that unauthorized access accounts for the bulk of cloud security incidents (64%), covering both simple exploits as well as sophisticated threats such as lateral movement and cross-cloud attacks. Companies are beginning to recognize their vulnerabilities–nearly two thirds (65%) of CSTR respondents believe the increasing complexity of their organization's cloud infrastructure is opening them up to entirely new and dangerous threat vectors.

For example, identity-related attacks have escalated in the cloud, making proper identity and access management the fundamental backbone of security across domains in a highly virtualized technology stack. The speed with which cloud can be "spun up" and the often-decentralized manner in which it is deployed magnifies human errors and creates vulnerabilities that attackers can exploit. A lack of visibility into detailed cloud usage hampers optimal policies and controls.

> {{{ The report also revealed that enterprises underestimate the scale and complexity of cloud threats. }}}

As CSA delved into this report, we found strong alignment with the best practices research and education we advocate. As the CSTR reveals, a Zero Trust strategy, building out a software-defined perimeter, and adopting serverless and containerization technologies are critical building blocks for a mature cloud security posture.

The CSTR also advises organizations to develop robust governance strategies supported by a Cloud Center of Excellence (CCoE) to rally stakeholder buy-in and get everyone working from the same enterprise roadmap. Establishing security as a continuous process rather than front-loading efforts at the onset of procurement and deployment is a necessity given the frenetic pace of change.

As the CSTR suggests and we can confirm, security architectures must also be designed with an eye towards scalability, and automation and cloud-native approaches like DevSecOps are essential for minimizing errors, optimizing limited man power and facilitating new controls.

While there is a clear strategy for securing cloud operations, too few companies have embarked on the changes. Symantec internal data reports that 85% are not using best security practices as outlined by the Center for Internet Security (CIS). As a result, nearly three-quarters of respondents to the CSTR said they experienced a security incident in cloud-based infrastructure due to this immaturity.

> {{{ The CSTR is a pivotal first step in increasing that awareness. }}}

The good news is that the users of cloud have a full portfolio of solutions, including multi-factor authentication, data loss prevention, encryption and identity and authentication tools, at their disposal to address cloud security threats along with new processes and an educated workforce. The bad news is that many users of cloud are not aware of the full magnitude of their cloud adoption, the demarcation of the shared responsibility model and the inclination to rely on outdated security best practices. The CSTR is a pivotal first step in increasing that awareness.

Cloud is and will continue to be the epicenter of IT, and increasingly the foundation for cyber security. Understanding how threat vectors are shifting in cloud is fundamental to overhauling and modernizing an enterprise security program and strategy. CSA recommends the Symantec CSTR report be read widely and we look forward to future updates to its findings.

Download 2019 Cloud Security Threat Report >> https://resource.elq.symantec.com/LP=7326?inid=symc_cloud-security-threat-report_cstr_to_leadgen_form_LP-7326_cstr&CID=70138000001FlejAAC

Interested in learning more? You can watch our CloudBytes webinar with Jim Reavis, Co-Founder & CEO at Cloud Security Alliance, and Kevin Haley, Director Security Technology and Response at Symantec as they discuss the key findings from the 2019 Cloud Security Threat Report. Watch it here >>
//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/30/organizations-must-realign-to-face-new-cloud-realities/]] sur le blog de la CSA
!1 - Les nouveautés CSA de la semaine du 22 au 28 juillet 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Etat d'avancement du programme pilote FedSTAR''+++*[»]> <<tiddler [[2019.07.24 - Blog : Etat d'avancement du programme pilote FedSTAR]]>>=== 
* Actu : ''Best Practices for Implementing a Secure Application Container Architecture''+++*[»]> <<tiddler [[2019.07.26 - Actu : 'Cloud Security Alliance Releases Best Practices for Implementing a Secure Application Container Architecture']]>>=== 
* Publication : ''Best Practices for Implementing a Secure Application Container Architecture''+++*[»]> <<tiddler [[2019.07.26 - Publication : 'Best Practices for Implementing a Secure Application Container Architecture']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.07.28 - Veille Hebdomadaire]] avec plus de 80 liens :
* Piratages et fuites de données : fuite FormGet, phishing O365, suites de l'attaque contre iNSYNQ
* Rapports et sondages : Checkpoint, Cyren/Osterman, PaloAlto Networks, RiskRecon/Cyentia, SkyBox, et Symantec
* Divers : suite du CLOUD Act, SSO et IAM dans le Cloud, importance des contrats Cloud, outils de tests, DarkWeb et MaaS
!3 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Juillet|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.07.28|
|2019.07.28|ITwire|[[Email attacks having a major impact on businesses: study|https://www.itwire.com/security/email-attacks-having-a-major-impact-on-businesses-study.html]]|Report Barracuda|
|>|>|>|!2019.07.27|
|2019.07.27|Packt|![[Understanding security features in the Google Cloud Platform (GCP)|https://hub.packtpub.com/understanding-security-features-in-the-google-cloud-platform-gcp/]]|GCP|
|>|>|>|!2019.07.26|
|2019.07.26|CERT-EU|[[Cloud hosting firm iNSYNQ hit byransomware attack|https://media.cert.europa.eu/static/MEMO/2019/TLP-WHITE-CERT-EU-MEMO-190726-1.pdf]]|Attacks Ransomware iNSYNQ|
|2019.07.26|Infosec Institute|[[Amazon Inspector: A cloud-based vulnerability assessment tool|https://resources.infosecinstitute.com/amazon-aws-inspector-walkthrough/]]|AWS Control|
|2019.07.26|Solutions Review|[[7 Cloud Security Best Practices to Keep Your Cloud Environment Secure|https://solutionsreview.com/cloud-platforms/7-cloud-security-best-practices-to-keep-your-cloud-environment-secure/]]|Best_Practices|
|2019.07.26|Forbes|[[Why Invest In Cloud-Based Machine Learning For Cybersecurity?|https://www.forbes.com/sites/extrahop/2019/07/26/why-invest-in-cloud-based-machine-learning-for-cybersecurity/]]|MachineLearning|
|2019.07.26|Center for Internet Security|[[Cleaning Out Your Old Data and Devices|https://www.cisecurity.org/newsletter/cleaning-out-your-old-data-and-devices/]]|Cleaning|
|2019.07.26|The Register|[[Don't fall into the trap of thinking you're safe and secure in the cloud. It could become a right royal pain in the SaaS|http://go.theregister.com/feed/www.theregister.co.uk/2019/07/26/secure_saas_in_the_smb/]]|SaaS|
|2019.07.26|//RiskRecon / Cyentia//|![[RiskRecon and Cyentia Institute: Definitive Study on Cloud Security Risk Quantifies Global Industry Exposure and Reveals Predictors of Cloud Success|https://blog.riskrecon.com/company/news-releases/definitive-study-on-cloud-security-risk-quantifies-global-industry-exposure]] ([[rapport|https://www.riskrecon.com/cloud-risk-surface-report]]|Report RiskRecon|
|2019.07.26|//TechBeacon / HP//|[[How to secure your cloud infrastructure: The 3 planes of OpSec|https://techbeacon.com/security/how-secure-your-cloud-infrastructure-3-planes-opsec]]|OpSec|
|2019.07.26|//Google//|[[Least privilege for Cloud Functions using Cloud IAM|https://cloud.google.com/blog/products/application-development/least-privilege-for-cloud-functions-using-cloud-iam/]]|GCP IAM|
|2019.07.26|//JumpCloud//|[[What is AWS SSO?|https://jumpcloud.com/blog/aws-sso/]]|AWS SSO|
|2019.07.26|BetaNews|[[Microsoft's web-based Outlook 365 is leaking users' IP addresses in emails|https://betanews.com/2019/07/26/microsoft-office-outlook-365-ip-leak/]]|O365 Data_Leak|
|2019.07.26|//Anchore//|[[Federal Container Security Best Practices - Unifying Configuration Management and Container Security with Anchore Enterprise|https://anchore.com/federal-container-security-best-practices-unifying-configuration-management-and-container-security-with-anchore-enterprise/]]|Containers Best_Practices|
|>|>|>|!2019.07.25|
|2019.07.25|CNet[>img[iCSF/flag_fr.png]]|[[Cloud computing : connaître les risques et savoir l'utiliser|https://www.cnetfrance.fr/produits/cloud-computing-connaitre-les-risques-et-savoir-l-utiliser-39762624.htm]]|Risks|
|2019.07.25|Les Numériques[>img[iCSF/flag_fr.png]]|[[Apple, Google, Microsoft, Dropbox... Quels sont les meilleurs services cloud ?|https://www.lesnumeriques.com/vie-du-net/apple-google-microsoft-dropbox-quels-sont-les-meilleurs-services-cloud-a138185.html]]|Misc|
|2019.07.25|CyberDefense Mag|[[Adapting Security Policies to Fit the Cloud Computing Era|https://www.cyberdefensemagazine.com/adapting-security-policies/]]|Security_Policy|
|2019.07.25|Bleeping Computer|[[Microsoft Office 365 Webmail Exposes User's IP Address in Emails|https://www.bleepingcomputer.com/news/microsoft/microsoft-office-365-webmail-exposes-users-ip-address-in-emails/]]|O365 Data_Leak|
|2019.07.25|TechCrunch|[[FormGet security lapse exposed thousands of sensitive user-uploaded documents|https://techcrunch.com/2019/07/25/formget-security-lapse-exposed-documents/]]|AWS S3 Bucket Data_Leak|
|2019.07.26|Cyware| → [[FormGet exposed company documents and customer data due to unsecured AWS S3 storage bucket|https://cyware.com/news/formget-exposed-company-documents-and-customer-data-due-to-unsecured-aws-s3-storage-bucket-5002fc3f]]|AWS S3 Bucket Data_Leak|
|2019.07.25|Solutions Review|[[What Is Software as a Service? A Beginner's Guide to SaaS|https://solutionsreview.com/cloud-platforms/what-is-software-as-a-service-a-beginners-guide-to-saas/]]|SaaS|
|2019.07.25|Cloud Native Computing Foundation|[[The 10 Most Viewed Videos from Past KubeCon + CloudNativeCons|https://www.cncf.io/blog/2019/07/25/the-10-most-viewed-videos-from-past-kubecon-cloudnativecons/]]|Kubernetes Conference|
|2019.07.25|FCW|[[Contracting, cloud essential to modernizing House IT|https://fcw.com/articles/2019/07/25/house-it-modernization.aspx]]|Contracting|
|2019.07.25|AccountingWeb|[[How to Manage Your Vendors for Better Security|https://www.accountingweb.com/technology/trends/how-to-manage-your-vendors-for-better-security]]|Third_Party|
|2019.07.25|Chef|![[Secure Your Cloud Estate with Continuous Audits|https://blog.chef.io/2019/07/25/secure-your-cloud-estate-with-continuous-audits/]]|Continuous_Audit|
|2019.07.25|LeMagIT[>img[iCSF/flag_fr.png]]|[[PRA en cloud : à quoi faut-il s'attendre ?|https://www.lemagit.fr/conseil/PRA-en-cloud-a-quoi-faut-il-sattendre]]|DRP|
|2019.07.25|//Checkpoint//|[[From Supply Chain to Email, Mobile and the Cloud, No Environment is Immune to Cyber Attacks|https://www.globenewswire.com/news-release/2019/07/25/1888032/0/en/Check-Point-Research-From-Supply-Chain-to-Email-Mobile-and-the-Cloud-No-Environment-is-Immune-to-Cyber-Attacks.html]]|Report Checkpoint|
|2019.07.25|//Checkpoint//| → [[Cyber Attack Trends: Annual Report 2019 1H (téléchargement)|https://pages.checkpoint.com/cyber-attack-2019-trends.html]]|Report Checkpoint|
|2019.07.25|IT Social[>img[iCSF/flag_fr.png]]| → [[Cloud public : une sécurité à renforcer|https://itsocial.fr/enjeux/cloud-computing/cloud-public-prive-hybride/cloud-public-securite-a-renforcer-2/]]|Public_Cloud|
|2019.07.25|//Managed Methods//|[[Cloud Application Security Checklist|https://managedmethods.com/blog/cloud-application-security-checklist/]]|Checklist|
|2019.07.25|//RedScan//|[[The rise of Office 365 phishing scams: How one compromised account can cost millions|https://www.cloudcomputing-news.net/news/2019/jul/25/rise-office-365-phishing-scams-how-one-compromised-account-can-cost-millions/]]|O365 Phishing|
|2019.07.25|//Azure//|[[Azure publishes guidance for secure cloud adoption by governments|https://azure.microsoft.com/en-us/blog/azure-publishes-guidance-for-secure-cloud-adoption-by-governments/]] ([[document|https://aka.ms/AzureWWPS]])|Azure Guidance Government|
|2019.07.25|//Lastline//|[[Built-in Cloud Security Controls Essential to Securing an Expanded Network, Assert CISOs|https://www.lastline.com/blog/built-in-cloud-security-controls-essential-to-securing-an-expanded-network-assert-cisos/]]|Controls|
|2019.07.25|//CloudCheckr//|[[Your Organization's Role in the Shared Responsibility Model|https://cloudcheckr.com/document/shared-responsibility-model/]] (après incription)|Shared_Responsibility|
|2019.07.25|//JumpCloud//|[[Azure AD LDAP Server|https://jumpcloud.com/blog/azure-ad-ldap-server/]]|AzureAD LDAP|
|>|>|>|!2019.07.24|
|2019.07.24|CERT-EU|[[Hacking groups compete for cryptojacking cloud-based infrastructure|https://media.cert.europa.eu/static/MEMO/2019/TLP-WHITE-CERT-EU-MEMO-190514-1.pdf]]|CryptoJacking|
|2019.07.24|CERT-EU|[[Docker breach exposes a significant number of accounts|https://media.cert.europa.eu/static/MEMO/2019/TLP-WHITE-CERT-EU-MEMO-190430-1.pdf]]|Breach Docker|
|2019.07.24|DZone|![[AWS Resources That Should Be Backed Up|https://dzone.com/aricles/aws-resources-that-should-be-backed-up-and-how-to]]|AWS BackUps|
|2019.07.24|DZone|[[Serverless Multi-Tier Architecture on AWS|https://dzone.com/articles/serverless-multi-tier-architecture-on-aws]]|AWS Serverless|
|2019.07.24|DZone|[[Cloud vs. On-Premise Software Deployment - What's Right for You? |https://dzone.com/articles/cloud-vs-on-premise-software-deployment-whats-righ]]|Misc|
|2019.07.24|DZone|[[Top 10 AWS Architect Interview Questions 2019|https://dzone.com/articles/top-10-aws-architect-interview-questions-2019]]|AWS|
|2019.07.24|TechRepublic|[[How to prevent unsigned Docker images from being pulled|https://www.techrepublic.com/article/how-to-prevent-unsigned-docker-images-from-being-pulled/]]|Docker|
|2019.07.24|//PaloAlto Networks//|![[Cloudy with a Chance of Entropy|https://www.paloaltonetworks.com/resources/research/unit42-cloud-with-a-chance-of-entropy]] ([[rapport|https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/research/unit42-cloud-with-a-chance-of-entropy]])|Report PaloAlto Misconfigurations|
|2019.07.24|SiliconAngle| → [[Report finds 34M vulnerabilities across AWS, Google Cloud and Azure|https://siliconangle.com/2019/07/24/report-finds-34m-vulnerabilities-across-aws-google-cloud-azure/]]|AWS Azure GCP Containers Vulnerabilities|
|2019.07.25|Global Security Mag[>img[iCSF/flag_fr.png]]| → [[Palo Alto Networks identifie plus de 34 millions de vulnérabilités dans les ressources AWS, Azure et GCP|http://www.globalsecuritymag.fr/Palo-Alto-Networks-identifie-plus,20190725,89448.html]]|AWS Azure GCP Containers Vulnerabilities|
|2019.07.26|CSO| → [[Over a quarter of cloud loads have been compromised by cryptojackers|https://www.cso.com.au/article/664586/over-quarter-cloud-loads-been-compromised-by-cryptojackers/]]|
|2019.07.24|//Avanan//|[[Office 365 Credential Validator Phishing Attack|https://www.avanan.com/resources/office-365-credential-validator-phishing-attack]]|O365 Phishing|
|2019.07.24|HelpNet Security| → [[Phishers targeting Office 365 admins have a new trick up their sleeve|https://www.helpnetsecurity.com/2019/07/24/phishers-targeting-office-365-admins/]]|O365 Phishing|
|2019.07.24|//Rapid7//|[[Why the Modern SIEM Is in the Cloud|https://blog.rapid7.com/2019/07/24/why-the-modern-siem-is-in-the-cloud/]]|SIEM|
|2019.07.24|//ResearchAndMarkets//|[[Global Cyber Security Markets to 2025 - Growing Use of Cloud-Based Security Solutions|https://www.globenewswire.com/news-release/2019/07/24/1887393/0/en/Global-Cyber-Security-Markets-to-2025-Growing-Use-of-Cloud-Based-Security-Solutions.html]]|Report|
|2019.07.24|//SkyBox Security//|[[Cloud Container Vulnerabilities Soar, According to Report|https://www.bloomberg.com/press-releases/2019-07-24/skybox-security-cloud-container-vulnerabilities-soar-according-to-report]]|Report SkyBox|
|2019.07.25|Le Big Data[>img[iCSF/flag_fr.png]]| → [[Containers Cloud : les risques de cybersécurité ont crû 240% en 2 ans|https://www.lebigdata.fr/containers-cloud-risques-cybersecurite]]|Report SkyBox|
|2019.07.25|Forbes| → [[Why Cloud Computing Cyber Security Risks Are On The Rise: Report|https://www.forbes.com/sites/jeanbaptiste/2019/07/25/why-cloud-computing-cyber-security-risks-are-on-the-rise-report/]]|Report SkyBox|
|2019.07.24|//Alibaba//|[[8220 Mining Group Now Uses Rootkit to Hide Its Miners|https://medium.com/@Alibaba_Cloud/8220-mining-group-now-uses-rootkit-to-hide-its-miners-15d6c571cdb3]]|CryptoMining|
|>|>|>|!2019.07.23|
|2019.07.23|Journal du Net[>img[iCSF/flag_fr.png]]|[[Les participants des Rencontres du Cloud en interviews|https://www.journaldunet.com/solutions/cloud-computing/1441766-interviews-les-rencontres-du-cloud/]]|Conference|
|2019.07.23|Bleeping Computer|[[Microsoft to Improve Office 365 Malicious Email Analysis|https://www.bleepingcomputer.com/news/security/microsoft-to-improve-office-365-malicious-email-analysis/]]|O365 Detection|
|2019.07.23|CBR Online|[[Docker Enterprise 3.0: What's New?|https://www.cbronline.com/news/docker-enterprise-3-0-whats-new]]|Docker|
|2019.07.23|DZone|[[Understanding Dockerfile|https://dzone.com/articles/understanding-dockerfile]]|Docker|
|2019.07.23|GeekWire|[[Microsoft-owned LinkedIn is moving to the public cloud, and guess which platform it's choosing?|https://www.geekwire.com/2019/microsoft-owned-linkedin-moving-public-cloud-guess-platform-choosing/]]|Azure LinkedIn|
|2019.07.23|SecurityWeek|[[Attackers Turn Elasticsearch Databases Into DDoS Bots|https://www.securityweek.com/attackers-turn-elasticsearch-databases-ddos-bots]]|Attacks ElasticSearch|
|2019.07.23|CyberSecurity Insiders|[[Ways to help keep Cloud Security intact in the finance industry|https://www.cybersecurity-insiders.com/ways-to-help-keep-cloud-security-intact-in-the-finance-industry/]]|Misc|
|2019.07.23|//OVH//[>img[iCSF/flag_fr.png]]|[[Pourquoi il faut choisir le cloud européen|https://www.lesechos.fr/idees-debats/cercle/pourquoi-il-faut-choisir-le-cloud-europeen-1039819]]CLOUD_Act|
|2019.07.23|//Rhino Security Labs//|[[AWS IAM Privilege Escalation|https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation]]|AWS IAM|
|2019.07.23|//SecurityIntelligence / IBM//|[[What's New in the 2019 Cost of a Data Breach Report|https://securityintelligence.com/posts/whats-new-in-the-2019-cost-of-a-data-breach-report/]]|Report DataBreach|
|2019.07.23|//MDSec//|![[Introducing the Office 365 Attack Toolkit|https://www.mdsec.co.uk/2019/07/introducing-the-office-365-attack-toolkit/]]|O365 Tools|
|2019.07.23|//NetApp//|[[Challenges and Solutions of File Services in the Cloud Architecture|https://pupuweb.com/file-services-cloud-computing/]]|Misc|
|2019.07.23|//PaloAlto Networks//|[[4 Practical Steps for 'Shift Left' Security|https://blog.paloaltonetworks.com/2019/07/4-practical-steps-shift-left-security/]]|DevSecOps|
|2019.07.23|//Managed Methods//|[[Cloud Application Security Architecture for SaaS Security|https://managedmethods.com/blog/cloud-application-security-architecture/]]|Architecture|
|2019.07.23|//CyberDB//|[[Ten tips for better AWS cyber security|https://www.cyberdb.co/ten-tips-better-aws-cyber-security/]]|AWS Best_Practices|
|>|>|>|!2019.07.22|
|2019.07.22|DisruptOps|[[Dev, Sec and Ops: Communications Breakdown|https://disruptops.com/dev-sec-and-ops-communications-breakdown/]]|DevSecOps|
|2019.07.22|MSSP Alert|[[Hackers Attacking Misconfigured AWS S3 Cloud Buckets|https://www.msspalert.com/cybersecurity-breaches-and-attacks/aws-s3-bucket-data-leaks/]]|AWS_S3 Data_Leaks|
|2019.07.22|Dechert|[[Actual Impact of 2018 U.S. CLOUD Act Still Hazy|https://info.dechert.com/10/12598/july-2019/actual-impact-of-2018-u.s.-cloud-act-still-hazy.asp?sid=0a005ac3-1df4-43c4-a944-f723188079ce]]|CLOUD_Act|
|2019.07.22|Fox Rothschild|![[EU Agencies Issue Joint Response On Impact Of US CLOUD Act|https://dataprivacy.foxrothschild.com/2019/07/articles/european-union/gdpr/eu-agencies-issue-joint-response-on-impact-of-us-cloud-act/]]|CLOUD_Act|
|2019.07.22|Dark Reading|[[How Cybercriminals Break into the Microsoft Cloud|https://www.darkreading.com/cloud/how-cybercriminals-break-into-the-microsoft-cloud/d/d-id/1335314]]|Azure Attacks Conference|
|2019.07.22|Rick's Cloud|[[Multi-cloud strategy: battle of the clouds or the strongest alliance ever?|https://rickscloud.com/multi-cloud-strategy-battle-of-the-clouds-or-the-strongest-alliance-ever/]]|MultiCloud|
|2019.07.22|DZone|[[Microsoft Azure vs. Amazon Web Services: A Cloud Platform Comparison|https://dzone.com/articles/microsoft-azure-vs-amazon-web-services-a-cloud-pla]]|AWS Azure|
|2019.07.22|Kitploit|[[Dockernymous - A Script Used To Create A Whonix Like Gateway/Workstation Environment With Docker Containers |https://www.kitploit.com/2019/07/dockernymous-script-used-to-create.html]]|Docker Tools|
|2019.07.22|SiliconAngle|[[Zscaler transforms IT security from "castle and moat" to direct access via the cloud |https://siliconangle.com/2019/07/22/zscaler-transforms-security-castle-moat-direct-access-via-the-cloud-cubeconversations/]]|Misc|
|2019.07.22|//iNSYNQ//|![[Update: We're beginning to turn on customer desktops|https://blog.insynq.com/blog/update-were-beginning-to-turn-on-customer-desktops]]|Attacks Ransomware iNSYNQ|
|2019.07.22|SC Magazine| → [[Cloud-hosting firm iNSYNQ shut down by MegaCortex ransomware|https://www.scmagazine.com/home/security-news/ransomware/cloud-hosting-firm-insynq-shut-down-by-megacortex-ransomware/]]|Attacks Ransomware iNSYNQ|
|2019.07.23|InfoRiskToday| → [[iNSYNQ Continues Recovery From MegaCortex Ransomware Attack|https://www.inforisktoday.com/insynq-continues-recovery-from-megacortex-ransomware-attack-a-12816]]|Attacks Ransomware iNSYNQ|
|2019.08.08|AccountingToday| → [[Inside the Insynq attack: 'We had to assume they were listening'|https://www.accountingtoday.com/news/inside-the-insynq-ransomware-attack-we-had-to-assume-they-were-listening]]|Attacks Ransomware iNSYNQ|
|2019.07.22|//SecurityIntelligence / IBM//|![[The Dark Web Market Is Moving Toward IaaS and MaaS - Here's Why|https://securityintelligence.com/posts/the-dark-web-market-is-moving-toward-iaas-and-maas-heres-why/]]|DarkWeb IaaS MaaS|
|2019.07.22|//Stackrox//|[[Kubernetes Security 101 - Everything You Must Know to Secure k8s|https://www.stackrox.com/post/2019/07/kubernetes-security-101/]]|Kubernetes|
|2019.07.22|//Cyren//|[[Office 365 Email Security in the Enterprise: 2019 Benchmarking Survey|https://www.cyren.com/201906_RPT_O365_EmailSec_Survey]]|Report Cyren Osterman|
|2019.07.22|ZDnet| → [[40% of enterprises experienced Office 365 credential theft, report finds|https://www.techrepublic.com/article/40-of-enterprises-experienced-office-365-credential-theft-report-finds/]]|Report Cyren Osterman|
|2019.07.22|//Azure//|[[What's the difference between Azure Monitor and Azure Service Health?|https://azure.microsoft.com/en-us/blog/what-s-the-difference-between-azure-monitor-and-azure-service-health/]]|Azure Monitor|
|2019.07.22|//Tripwire//|[[Using AWS Session Manager with Enhanced SSH and SCP Capability|https://www.tripwire.com/state-of-security/security-data-protection/cloud/aws-session-manager-enhanced-ssh-scp-capability/]]|AWS SSH SCP|
|2019.07.22|//iland Internet//|[[Choosing A Cloud Provider for VMware Workloads? Ask These Questions First|https://cloudtweaks.com/2019/07/choosing-a-cloud-provider-vmware-workload/]]|VMware|
|2019.07.22|//eXemplify//|[[Security in the Cloud: Who's Responsible?|http://www.exemplifygroup.com/security-in-the-cloud-whos-responsible/]]|Misc|
|2019.07.22|//Checkpoint//|[[Secure your AWS, Azure and Google Environment Automatically with CloudBots|https://blog.checkpoint.com/2019/07/22/secure-your-aws-azure-and-google-environment-automatically-with-cloudbots/]]|CloudBots|
|2019.07.22|//Symantec//|[[How Immature Security Practices Complicate Cloud Migration|https://www.symantec.com/blogs/expert-perspectives/how-immature-security-practices-complicate-cloud-migration]]|Report Symantec|
|2019.07.26|IT World Canada| → [[More than 90% of security decision-makers fail to keep tabs on workloads in the cloud |https://www.itworldcanada.com/article/more-than-90-of-security-decision-makers-fail-to-keep-tabs-on-workloads-in-the-cloud/420387]]|Report Symantec|
|2019.08.09|Health Data Management|[[As cloud use rises among payers, so do cybersecurity concerns|https://www.healthdatamanagement.com/news/as-cloud-use-rises-among-payers-so-do-cybersecurity-concerns]]|Report Symantec|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Juillet 2019]]>>
!"//Cloud Security Alliance Releases Best Practices for Implementing a Secure Application Container Architecture//"
[>img(150px,auto)[iCSA/J7QPB.png]]Annonce de la CSA publiée le 26 juillet 2019.
<<<
//SEATTLE - July 26, 2019 - The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today released Best Practices for Implementing a Secure Application Container Architecture. Produced by the CSA's ''Application Containers and Microservices Working Group'', this paper is the second in a series of reports covering the securing of app containers and microservices and offers detailed recommendations and best practices to address the challenges laid out in the recently released "[[CSA Releases Research Identifying Challenges in Securing Application Containers and Microservices|2019.07.16 - Actu : 'CSA Releases Research Identifying Challenges in Securing Application Containers and Microservices']]".

Increasingly, enterprises are migrating to the cloud, and unsurprisingly, the number of stakeholders and their unique needs are growing at an exponential rate. Common ground is needed, then, to ensure that developers, operators, and architects are able to efficiently -- and effectively -- address the myriad components involved in application container architecture. Recognizing this, CSA is producing a series of white papers to facilitate secure migration to the crowd.

The paper was developed through extensive collaboration among a diverse group of participants with strong knowledge and practical experience in information security, operations, application containers, and microservices. Among the risks covered are: code promotion across environments, securing the host, container continuous monitoring from the platform/host, container networking, validating the integrity and security quality of the image, container forensics, trust chain through containers, container volume and secret management, platform and container management, and container encryption.

"Application containers and microservices architecture are being used to design, develop, and deploy applications, leveraging agile software development approaches such as development operations. Couple this with the fact that application containers and microservices have unique characteristics -- each with distinct security ramifications based on the stakeholder -- it's vital that security is embedded into the software development process," said Andrew Wild, Container and Microservices Working Group Co-chair. "It's CSA's hope that this document will serve as a springboard for careful examination and discussion of how to best secure application containers."//
[...]
<<<
&rArr; Lire [[la suite|https://cloudsecurityalliance.org/articles/csa-releases-best-practices-for-implementing-a-secure-application-container-architecture/]] sur le site de la CSA
!"//Best Practices for Implementing a Secure Application Container Architecture//"
<<<
[>img(150px,auto)[iCSA/J7QPB.png]]//Application containers and a microservices architecture are being used to design, develop and deploy applications leveraging agile software development approaches such as Development Operations. Security needs to be embedded into these software development approaches. This document serves to identify recommendations and best practices to address the challenges in securing application containers in the engineering of trustworthy secure systems through the lens of the Developer, Operator and Architect.//
<<<
__Table des matières :__
<<<
|TablNoBord|k
|.|Abstract|
|.|Acknowledgements|
|.|Executive Summary|
|1.|Introduction|
|1.1.|Purpose and Scope|
|1.2.|Document Structure|
|1.3.|Audience|
|2.|Application Container and Microservices|
|3.|Application Container Mitigations for Challenges|
|3.1.|Code Promotion Across Environments|
|3.2.|Securing the Host|
|3.3.|Container Continuous Monitoring from the Platform/Host|
|3.4.|Container Networking - Communications between Host and Container|
|3.5.|Container Networking - Communications between Containers|
|3.6.|Validate Integrity and Security Quality of the Image|
|3.7.|Container Forensics|
|3.8.|Trust Chain through Containers|
|3.9.|Container Volume Management|
|3.10.|Container Secret Management|
|3.11.|Platform Management - Notification of Lifecycle Events|
|3.12.|Platform Management - Resource Request|
|3.13.|Platform Management - Container Resource Management|
|3.14.|Container Management - Scaling Container Resources|
|3.15.|Container Management - Data Backups and Replication|
|3.16.|Container Management - Container rehosting between CMPs|
|3.17.|Container Encryption|
|.|Appendix A - Acronyms|
|.|Appendix B - Glossary|
|.|Appendix C - References|
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j7qc/|https://CloudSecurityAlliance.fr/go/j7qc/]]'' 
|!Juillet|!Sources|!Titres et Liens|!Synthèses|
|2019.07.26|CSA|[[Cloud Security Alliance Releases Best Practices for Implementing a Secure Application Container Architecture|https://cloudsecurityalliance.org/articles/csa-releases-best-practices-for-implementing-a-secure-application-container-architecture/]]|Second report in series provides mitigation options for 18 possible risks surrounding integration of application containers into trustworthy, secure systems|
|2019.07.16|CSA|[[Cloud Security Alliance Releases New Research Identifying Challenges in Securing Application Containers and Microservices|https://cloudsecurityalliance.org/articles/csa-releases-new-research-indentifying-challenges-in-securing-application-containers-and-microservices/]]|Report identifies challenges in securing application containers and microservices through the lens of the developer, operator and architect|
|2019.07.12|CSA|[[Cloud Security Alliance Releases Cloud Penetration Testing Playbook|https://cloudsecurityalliance.org/articles/cloud-security-alliance-releases-cloud-penetration-testing-playbook/]]|Reports provides foundation for public cloud penetration testing methodology|
|2019.07.02|CSA|[[Cloud Security Alliance Congress EMEA 2019 Call for Papers - Deadline Extended|https://cloudsecurityalliance.org/articles/csa-congress-emea-2019-call-for-papers-deadline-extended/]]|Papers examining new frontiers accelerating change in information security are sought|
!"//FedSTAR Pilot Program Status//"
[>img(150px,auto)[iCSA/J7OBF.jpg]]Article de blog publié le 24 juillet 2019
<<<
/%
À mesure que l'utilisation de la technologie cloud s'est généralisée, l'inquiétude suscitée par la sécurité du cloud s'est accrue. Les agences gouvernementales et les utilisateurs du secteur privé se préoccupent de la protection des données et de la disponibilité des services. De nombreux pays et entités privées ont conçu et mis en œuvre des programmes de sécurité pour accroître le niveau d'assurance et de confiance des services en nuage. En conséquence, plusieurs programmes de certification et d'accréditation ont été créés. En 2019, plus de 40 systèmes de certification de sécurité différents ont été développés et mis en œuvre dans le monde entier, y compris le programme CSA STAR.
D'une part, l'introduction de systèmes de certification et d'accréditation a simplifié la création de relations de confiance entre les fournisseurs de services dans le cloud (CSP) et les clients et, par conséquent, rationalisé les processus d'approvisionnement. D'autre part, la multiplication des schémas de certification a pour effet secondaire de générer une fatigue liée à la conformité. Ce problème a un impact significatif sur les ressources que les services de cloud computing doivent appliquer à la sécurité. De nombreux fournisseurs de services de contrôle ont un personnel dédié à la conformité aux multiples certifications de sécurité qui régissent leurs services. En plus de peser lourdement sur les CSP existants, la nécessité de se conformer à plusieurs certifications de sécurité est un obstacle majeur à l'entrée sur le marché des nouveaux CSP.
Il y a environ 18 mois, CSA a commencé à travailler avec le bureau du programme FedRAMP de la US General Services Administration sur l'idée de FedSTAR, un programme destiné à faciliter la reconnaissance des programmes FedRAMP et STAR. Le projet FedSTAR fait partie d'une initiative plus vaste de la CSA visant à faire évoluer STAR vers un cadre mondial permettant la reconnaissance multipartite de la certification nationale, internationale et spécifique à un secteur.
Il existe un programme équivalent à FedSTAR en Europe avec le projet EU-SEC. L'ASC a introduit l'idée d'une reconnaissance multipartite auprès de la communauté des parties prenantes, ce qui suscite beaucoup d'intérêt, tant de la part du gouvernement que du secteur privé.
Les projets FedSTAR et EU-SEC ont deux objectifs principaux:
* Construire une base pour la reconnaissance mutuelle entre la certification de sécurité, les attestations et les accréditations nationales, internationales et sectorielles
* Accorder une certification de confiance reconnue par les CSP et les clients
* Réduire les coûts de mise en conformité pour les CSP qui veulent satisfaire aux exigences de l'industrie et du gouvernement
* Exigences de support pour la surveillance continue
La solution à ce problème mondial n'est pas d'établir un nouveau système de certification de sécurité avec différents processus, preuves de conformité et contrôles à la source. FedSTAR vise plutôt à mettre au point un processus favorisant la reconnaissance mutuelle entre le gouvernement fédéral américain FedRAMP et le CSA STAR. La solution repose sur le fait que FedRAMP et CSA STAR s'appuient sur des ensembles de contrôles sanctionnés et largement utilisés en tant que source de conformité en matière de sécurité.
Le but de FedSTAR est qu'une fois que la société a obtenu la certification STAR ou l'autorisation d'exploitation de FedRAMP, elle ne peut obtenir cette certification qu'en auditant le delta de contrôles définissant les écarts entre les exigences de FedRAMP Moderate et de Cloud Control Matrix (CCM). ). À cet effet, l'équipe d'audit de FedSTAR serait obligée d'obtenir les accréditations du vérificateur principal de la certification STAR et des professionnels 3PAO.




%/ //As the use of cloud technology has become more widespread, the concern about cloud security has increased. Government agencies and private sector users are concerned with protecting data and ensuring service availability. Many countries and private entities have designed and implemented security programs to increase the level of assurance and trust of cloud services. As a result, multiple certifications and accreditation programs were created. As of 2019, over 40 different security certification systems have been developed and implemented worldwide, including the CSA STAR program.
On the one hand, the introduction of certification and accreditation systems has simplified the creation of trusted relationships between Cloud Services Providers (CSPs) and customers and consequently streamlined the procurement processes. On the other hand, the proliferation of certification schemas has the side effect of generating compliance fatigue. This issue is having a significant impact on the resources that cloud services must apply to security. Many CSPs have dedicated staff for ensuring compliance with multiple security certifications governing their services. In addition to being a resources drain on existing CSPs, the need to comply with multiple security certifications is a major obstacle to market entry for new CSPs.
About 18 months ago, CSA began working with the FedRAMP program office at the U.S. General Services Administration on the idea of FedSTAR, a program to facilitate the recognition between FedRAMP and STAR programs. The FedSTAR project is part of a larger CSA initiative aimed at evolving STAR to a global framework for multiparty recognition of national, international, and sector-specific certification.
There is an equivalent program to FedSTAR in Europe with the EU-SEC project. CSA introduced the idea of multiparty recognition to the stakeholder community, and there has been a lot of interest from both the government and private sectors.
Both FedSTAR and EU-SEC projects have four primary goals:
* Build a foundation for mutual recognition between national, international and sector-specific security certification, attestations and accreditations
* Grant a trusted certification that is recognized by CSPs and customers
* Reduce the compliance cost for CSPs that want to meet the requirements of both industry and government
* Support requirements for continuous monitoring
The solution to this global problem is not to establish a new security certification system with different processes, evidence of compliance, and source controls. Rather, FedSTAR aims to develop a process that supports mutual recognition between the U.S. Federal government FedRAMP and CSA STAR. The solution is based on the fact that both FedRAMP and CSA STAR are grounded in sanctioned, widely-used sets of controls as the source of security compliance.
The goal of FedSTAR is that once a company has achieved either STAR Certification or FedRAMP authorization to operate, that company can obtain the other certification only by auditing the delta of controls that defines the gaps between the requirements of FedRAMP Moderate and Cloud Control Matrix (CCM). In support of this, the FedSTAR auditing team would be required to have both the STAR Certification Lead Auditor and 3PAO professional accreditations.
[>img(500px,auto)[iCSA_/J7OFPPS.png]]
/%
Bien que STAR Certification et FedRAMP ne soient pas compatibles en l'état, ils ont des éléments de base communs, notamment le niveau de maturité de chaque programme, l'exigence d'évaluateurs tiers indépendants et l'utilisation d'examens basés sur le contrôle.
Notre hypothèse de travail, basée sur les recherches initiales, est que la reconnaissance mutuelle entre les deux systèmes serait facile à établir en raison du chevauchement des certifications FedRAMP Moderate et CSA CCM.
Ces facteurs ont conduit à notre décision de codifier les processus et de mesurer le niveau d'effort requis pour qu'un CSP passe de la certification modérée FedRAMP à la certification CSA STAR.

''Où sommes-nous actuellement?''
* Nous avons développé une analyse des écarts entre CSA STAR et FedRAMP modérée
* Nous avons mis en place un ensemble de mesures visant à quantifier le temps, le personnel et les autres ressources nécessaires pour obtenir une certification CSA STAR après avoir reçu une autorisation modérée d'exploitation de FedRAMP.
* Nous avons identifié un CSP qui a accepté d'inclure une évaluation de certification CSA STAR dans son examen annuel de la conformité à FedRAMP. cet effort débutera à la fin de l'été 2019. Ce sera notre premier projet pilote.

'' Mesures du succès ''
La CSA part de l'hypothèse de travail selon laquelle il lui faudra déployer des efforts minimes pour obtenir une certification CSA STAR à partir d'un ATO FedRAMP Moderate. Cependant, cette hypothèse doit être validée. Par conséquent, en collaboration avec les membres de la communauté des évaluateurs indépendants tiers, nous avons défini un ensemble de mesures que les participants pilotes ont accepté de collecter. Ces mesures incluent des critères qualitatifs et quantitatifs.
# Disponibilité / temps de préparation - Mesure quantitative permettant de comprendre les efforts requis par l'audité pour se préparer à un audit de certification STAR à partir d'un poste de FedRAMP Conformité moyenne - exprimée en nombre de jours-homme
# Temps d'audit - Mesure quantitative du temps requis pour obtenir la certification STAR? Quels sont les efforts nécessaires pour la préparation de la documentation et l'évaluation 3PAO?
# Exactitude de la cartographie et de l'analyse des écarts - CSA a fourni une "analyse de la cartographie et des écarts CCM-FedRAMP" à l'appui de cet effort. Nous demandons des commentaires sur l'utilité de la carte et l'efficacité des "contrôles compensatoires" proposés par la CSA.
# Réutilisation des preuves d'audit - Identification des documents et des preuves créés lors d'un audit FedRAMP pouvant être appliqués aux exigences de CCM V3.0.1
# Base de compétences - Quelles sont les compétences requises pour effectuer un audit FedRAMP à CSA STAR? Le CSP devait-il fournir des compétences supplémentaires pour obtenir la certification STAR?
# Le pilote recueillera également des informations sur les outils fournis pour faciliter son exécution.

''Prochaines étapes''
Le moment est maintenant critique pour le projet FedSTAR. Nous avons effectué la planification et le développement de l'infrastructure appropriés. Nos séances d'information sur le programme - réalisées en collaboration avec FedRAMP - ont suscité l'intérêt de la communauté du cloud. Le moment est venu d'exécuter les projets pilotes et d'analyser les résultats. Un programme pilote débutera à la fin de l'été 2019.
* Besoin de CSP supplémentaires pour s'inscrire pour participer au programme
* Nécessité de créer un groupe de discussion pour examiner les résultats du projet pilote et guider le programme
%/
While STAR Certification and FedRAMP are not compatible as deployed, they have basic elements in common including the level of maturity of each program, the requirement for independent 3rd party assessors and the use of control-based reviews.
Our working assumption, based on initial research, is that the mutual recognition between the two systems would be easy to establish because of the overlap between the FedRAMP Moderate and CSA CCM certifications.
These factors led to our decision to codify processes and measure the level of effort required for a CSP to go from FedRAMP moderate certification to CSA STAR certification.

''Where are we now?''
* We have developed a gap analysis between CSA STAR and FedRAMP moderate
* We have established a set of measures designed to quantify the time, staff and other resources needed to obtain a CSA STAR certification after receiving a FedRAMP moderate authorization to operate
* We have identified one CSP who has agreed to include a CSA STAR certification assessment in its annual review for FedRAMP compliance; this effort will begin in late summer 2019. This will be our first pilot.

''Measures of Success''
CSA has the working assumption that it will require a minimal level of effort to receive a CSA STAR certification starting from a FedRAMP Moderate ATO. However, this hypothesis must be validated. Therefore, working with members of the Third Party Independent Assessor community, we have established a set of measures that pilot participants have agreed to collect. These measures include both qualitative and quantitative criteria.
# Readiness/Preparation time - Quantitative measure to understand the effort required by the auditee to prepare for a STAR Certification audit starting from a position of FedRAMP Moderate compliance - expressed in the number of man-days
# Audit time - Quantitative measure of the time required to get the STAR certification? Specifically what effort is needed for documentation preparation and 3PAO assessment
# Accuracy of the mapping and gap analysis - CSA has provided a "CCM-FedRAMP Mapping and Gap Analysis" to support this effort. We are asking for comments on the usefulness of the Map and the effectiveness of the "compensating controls" suggested by CSA
# Re-use of audit evidences - Identification of those documents and evidences created during a FedRAMP audit that can be applied to the requirements of CCM V3.0.1
# Skill Base - What are the skills required to complete a FedRAMP to CSA STAR audit? Were there additional skills that the CSP need to provide to complete the STAR Certification?
# The pilot will also collect information on the tools provided to facilitate pilot execution.

''Next Steps''
Now is a critical time for the FedSTAR project. We have done the appropriate planning and infrastructure development. Our briefings on the program - done in conjunction with FedRAMP - have generated interest in the cloud community. The time is right to execute the pilots and analyze the results. One pilot program will begin in late Summer 2019.
* Need additional CSPs to sign-up to participate in the program
* Need to establish a Focus Group to review pilot results and guide the program
//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/24/fedstar-pilot-program-status/]] sur le blog de la CSA
!1 - Les nouveautés CSA de la semaine du 15 au 21 juillet 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Shift Left' to Harden Your Cloud Security Posture''+++*[»]> <<tiddler [[2019.07.18 - Blog : 'Shift Left to Harden Your Cloud Security Posture']]>>=== 
* Blog : ''Partage d'expérience Cloud dans le Secteur Financier''+++*[»]> <<tiddler [[2019.07.19 - Blog : Partage d'expérience Cloud dans le Secteur Financier]]>>=== 
* Publication : ''Best Practices for Implementing a Secure Application Container Architecture''+++*[»]> <<tiddler [[2019.07.16 - Publication : 'Best Practices for Implementing a Secure Application Container Architecture']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.07.21 - Veille Hebdomadaire]] avec une cinquantaine de liens :
* Piratages et fuites de données : nouvelle attaque de raçongiciel chez un prestataire Cloud (iNSYNQ)
* Rapports et sondages : Alcide, Bitglass, Blackblaze, Duo Security, Gartner, Synopsys
* Divers : OVH en cours de qualification SecNumCloud, Docker, tests d'intrusion
!3 - Agenda
* ''28 __juillet__'' : __''Dernière semaine''__ pour soumettre une proposition pour le ''CSA Congress EMEA'' des 20 et 21 novembre 2019 à Berlin+++*[»]> <<tiddler [[2019.06.21 - Actu : Encore un mois pour soumettre un sujet au CSA Congress EMEA 2019]]>>=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Juillet|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.07.21|
|2019.07.21|Bleeping Computer|[[Phishers Target Office 365 Admins with Fake Admin Alerts|https://www.bleepingcomputer.com/news/security/phishers-target-office-365-admins-with-fake-admin-alerts/]]|O365 Phishing|
|>|>|>|!2019.07.20|
|2019.07.20|0x00sec|[[A Blue Team guide to AWS Cloudtrail monitoring|https://0x00sec.org/t/a-blue-team-guide-to-aws-cloudtrail-monitoring/15086/]]|AWS Monitoring|
|>|>|>|!2019.07.19|
|2019.07.19|Challenges[>img[iCSF/flag_fr.png]]|![[Face au Cloud Act américain, le grand retour du "cloud souverain" français|https://www.challenges.fr/entreprise/face-au-cloud-act-americain-le-grand-retour-du-cloud-souverain-franais_664976]]|CLOUD_Act Sovereign_Cloud|
|2019.07.19|Les Echos[>img[iCSF/flag_fr.png]]|![[Cloud Act : Amazon traite les requêtes de la justice américaine|https://www-lesechos-fr.cdn.ampproject.org/c/s/www.lesechos.fr/amp/1039103]]|CLOUD_Act AWS|
|2019.07.19|DZone|[[Containers Without Docker|https://dzone.com/articles/containers-with-out-docker]]|Containers Docker|
|2019.07.19|HelpNet Security|[[New open source solution reduces the risks associated with cloud deployments|https://www.helpnetsecurity.com/2019/07/19/reduce-cloud-deployment-risks/]]|AWS UCE|
|2019.07.19|//Lacework//|[[Cloud Security Incident Response: Continuous vs. Emergency Approaches|https://www.lacework.com/continuous-cloud-security-incident-response/]]|Incident_Response|
|2019.07.19|//Checkpoint//[>img[iCSF/flag_fr.png]]|[[Le Rapport de sécurité du Cloud 2019 de Check Point identifie l'éventail des problèmes de sécurité des entreprises dans les Clouds publics|http://www.globalsecuritymag.fr/Le-Rapport-de-securite-du-Cloud,20190717,89196.html]]|Report Checkpoint|
|2019.07.19|//iNSYNQ//|![[iNSYNQ experienced a ransomware attack on 7/16/19 perpetrated by unknown malicious attackers|https://www.insynq.com/support/#status]]|Attacks Ransomware|
|2019.07.19|MSSP Alert| → [[Ransomware Attacks Cloud Service Provider Insynq; MSPs Impacted|https://www.msspalert.com/cybersecurity-breaches-and-attacks/ransomware/insynq-outage/]]|Attacks Ransomware|
|2019.07.19|Bleeping Computer| → [[iNSYNQ Cloud Hosting Provider Hit by Ransomware Attack|https://www.bleepingcomputer.com/news/security/insynq-cloud-hosting-provider-hit-by-ransomware-attack/]]|Attacks Ransomware|
|2019.07.19|Krebs On Security| → [[QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware Attack|https://krebsonsecurity.com/2019/07/quickbooks-cloud-hosting-firm-insynq-hit-in-ransomware-attack/]]|Attacks Ransomware|
|2019.07.19|//Chef//|[[Don't Leave Your S3 Buckets Wide Open|https://blog.chef.io/2019/07/19/dont-leave-your-s3-buckets-wide-open/]]|Protection S3|
|2019.07.19|//Inedo//|[[50+ Kubernetes DevOps Tools on GitHub|https://blog.inedo.com/50-kubernetes-devops-tools-github]]|Kubernetes Tools|
|2019.07.19|ZDnet|[[Encryption laws to run up against CLOUD Act and GDPR: Law Council|https://www.zdnet.com/article/encryption-laws-to-run-up-against-cloud-act-and-gdpr-law-council/]]|CLOUD_Act|
|>|>|>|!2019.07.18|
|2019.07.18|Global Security Mag[>img[iCSF/flag_fr.png]]|[[L'adoption rapide et massive du cloud public réforme les modèles de sécurité des entreprises|http://www.globalsecuritymag.fr/L-adoption-rapide-et-massive-du,20190718,89247.html]]|Misc|
|2019.07.18|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[Google Cloud certifié hébergeur de données de santé en France|https://www.lemondeinformatique.fr/actualites/lire-google-cloud-certifie-hebergeur-de-donnees-de-sante-en-france-75949.html]]|CGP Healthcare France|
|2019.07.18|Ronnie Flathers|![[Docker for Pentesters|https://blog.ropnop.com/docker-for-pentesters/]]|Docker PenTesting|
|2019.07.18|Bleeping Computer|[[Fake Office 365 Site Pushes Trickbot Trojan as Browser Update|https://www.bleepingcomputer.com/news/security/fake-office-365-site-pushes-trickbot-trojan-as-browser-update/]]|O365 Phishing|
|2019.07.18|DZone|![[Why I Am Worried About My Personal Data in The Cloud|https://dzone.com/articles/why-am-i-worried-about-my-personal-data-in-the-clo]]|Privacy|
|2019.07.18|SecurityTrails|[[How to Install Kali Linux in the Cloud|https://securitytrails.com/blog/install-kali-linux-cloud]]|Audit Tools|
|2019.07.18|Down the Security Rabbitole|[[DtSR Episode 354 - Pragmatic Azure Security|http://podcast.wh1t3rabbit.net/dtsr-episode-354-pragmatic-azure-security]] ([[podcast|http://hwcdn.libsyn.com/p/8/b/1/8b1e1c3fa9a57563/DtSR_Episode_354_-_Pragmatic_Azure_Security.mp3]])|Azure|
|2019.07.18|TechRadar Pro|[[.cloud domains: a name that's made for fame|https://www.techradar.com/news/cloud-domains-a-name-thats-made-for-fame]]|Domains|
|2019.07.18|//iland Internet//|[[Migrating infrastructure to the cloud -- what the board needs to know|https://betanews.com/2019/07/18/migrating-infrastructure-to-the-cloud/]]|Governance Risks|
|2019.07.18|//Lacework//|[[How to Improve Breach Detection in the Cloud|https://www.lacework.com/improve-breach-detection-cloud/]]|Breach Detection|
|2019.07.18|//Tripwire//|[[Multi-Cloud Security Best Practices Guide|https://www.tripwire.com/state-of-security/security-data-protection/cloud/multi-cloud-security-best-practices-guide/]]|MultiCloud Best_Practices|
|2019.07.18|//Security Intelligence//|![[Does Your Cloud Vendor Contract Include These Crucial Security Requirements?|https://securityintelligence.com/posts/does-your-cloud-vendor-contract-include-these-crucial-security-requirements/]]|Contracts|
|2019.07.18|//Cylance//|[[Benefits, Risks, and Insurance Issues in the Cloud|https://threatvector.cylance.com/en_us/home/benefits-risks-and-insurance-issues-in-the-cloud.html]]|Compliance|
|2019.07.18|//Managed Methods//|[[Is Microsoft Cloud Secure? Office 365 Apps Security|https://managedmethods.com/blog/is-microsoft-cloud-secure/]]|Azure O365|
|2019.07.18|//Azure//|[[Azure Monitor for containers with Prometheus now in preview|https://azure.microsoft.com/en-us/blog/azure-monitor-for-containers-with-prometheus-now-in-preview/]]|Azure Containers Monitoring|
|2019.07.18|//HiveMQ//|[[A Better Solution for IoT Security and MQTT|https://www.hivemq.com/blog/a-better-solution-for-iot-security-and-mqtt/]]|IoT MQTT|
|>|>|>|!2019.07.17|
|2019.07.17|disruptOps|[[Cloud Security CoE Shared Services|https://disruptops.com/cloud-security-coe-shared-services/]]|Best_Practices|
|2019.07.17|DFRWS|[[AFF4-L: A scalable open logical evidence container|http://dfrws.org/sites/default/files/session-files/paper-aff4_l_a_scalable_open_logical_evidence_container.pdf]]|Forensics Conference|
|2019.07.17|Felix Felix Wilhelm|![[Quick and dirty way to get out of a privileged k8s pod or docker container by using cgroups release_agent feature|https://mobile.twitter.com/_fel1x/status/1151487053370187776/]]|Docker Vulnerability PoC|
|2019.07.19|//Trail of Bits//| → [[Understanding Docker container escapes|https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/]]|Docker Vulnerability PoC|
|2019.07.17|Infosecurity Mag|[[93% of Orgs Worry About Cloud Security|https://www.infosecurity-magazine.com/news/93-of-orgs-worry-about-cloud]]|Report|
|2019.07.17|HelpNet Security|[[As cyber attacks increase, the cloud-based database security market grows|https://www.helpnetsecurity.com/2019/07/17/cloud-based-database-security-market/]]|Report ResearchAndMarkets|
|2019.07.17|//Synopsys//|[[2019 Cloud Security Report|https://www.synopsys.com/software-integrity/resources/analyst-reports/security-in-the-cloud.html]]|Report Synopsis|
|2019.07.17|AWS Insider.net| → [[Cloud Security Survey: Top Concern Is Data Loss/Leakage|https://awsinsider.net/articles/2019/07/17/cloud-security-report.aspx]]|Report Synopsis|
|2019.07.17|Dark Reading| → [[Data Loss, Leakage Top Cloud Security Concerns|https://www.darkreading.com/cloud/data-loss-leakage-top-cloud-security-concerns/d/d-id/1335277]]|Report Synopsis|
|2019.07.17|Computer Weekly| → [[Most security pros still concerned about public cloud security|https://www.computerweekly.com/news/252466841/Most-security-pros-still-concerned-about-public-cloud-security]]|Report Synopsis|
|2019.07.17|//Bitglass//|[[Bitglass 2019 Cloud Security Report: Only 20 Percent of Organizations Use Cloud Data Loss Prevention Despite Storing Sensitive Information in the Cloud|https://www.businesswire.com/news/home/20190717005003/en/Bitglass-2019-Cloud-Security-Report-20-Percent]]|Report Bitglass|
|2019.07.18|HelpNet Security| → [[Adoption rates of basic cloud security tools and practices still far too low|https://www.helpnetsecurity.com/2019/07/18/basic-cloud-security-tools/]]|Report Bitglass|
|2019.07.17|//Alibaba//|[[How to Enable Transparent Data Encryption on Alibaba Cloud|https://medium.com/@Alibaba_Cloud/how-to-enable-transparent-data-encryption-on-alibaba-cloud-b46cbb86b96d]]|Alibaba Encryption|
|2019.07.17|//HiveMQ//|[[Client, Broker / Server and Connection Establishment - MQTT Essentials: Part 3|https://www.hivemq.com/blog/mqtt-essentials-part-3-client-broker-connection-establishment/]] (3/5)|MQTT|
|>|>|>|!2019.07.16|
|2019.07.16|DZone|![[Automated Remediation for Cloud-Specific Threats|https://dzone.com/articles/automated-remediation-for-cloud-specific-threats]]|Threats|
|2019.07.16|Container Journal|[[The 3 Phases of Containerization|https://containerjournal.com/2019/07/16/the-3-phases-of-containerization/]]|Containers|
|2019.07.16|Solutions Review|[[What Are the Benefits of a Cloud Managed Service Provider?|https://solutionsreview.com/cloud-platforms/what-are-the-benefits-of-a-cloud-managed-service-provider/]]|CloudMSP|
|2019.07.16|OVH[>img[iCSF/flag_fr.png]]|[[Private Cloud en cours de qualification SecNumCloud|https://www.ovh.com/fr/blog/private-cloud-en-cours-de-qualification-secnumcloud/]]|Certification|
|2019.07.16|//Gartner//|[[G00365830: Magic Quadrant for Cloud Infrastructure as a Service, Worldwide|https://www.gartner.com/en/documents/3947472]]|Gartner|
|2019.07.18|Silicon Angle| → [[Google gains ground in Gartner's latest Magic Quadrant for cloud infrastructure |https://siliconangle.com/2019/07/18/google-gains-ground-gartners-latest-magic-quadrant-cloud-infrastructure-services/]]|Gartner IaaS|
|2019.07.18|ZDnet| → [[Google Cloud gains in Gartner's 2019 cloud infrastructure Magic Quadrant|https://www.zdnet.com/article/google-cloud-gains-in-gartners-2019-cloud-infrastructure-magic-quadrant/]] ([[quadrant|https://zdnet3.cbsistatic.com/hub/i/2019/07/18/de65f5b8-eb36-469c-8597-43bbc2af6a64/0d6e05e2ccdc7ee56d4212632233a7e5/gartner-iaas-2019-mq.png]])|Gartner IaaS|
|2019.07.19|CRN| → [[Gartner's 2019 Magic Quadrant For Cloud IaaS: Six Top Providers|https://www.crn.com/slide-shows/cloud/gartner-s-magic-quadrant-for-cloud-iaas-six-top-providers]]|Gartner IaaS|
|2019.07.22|AWS Insider| → [[AWS Dominates Cloud Infrastructure Report for 9th Year|https://awsinsider.net/articles/2019/07/22/gartner-iaas-2019.aspx]]|Gartner IaaS|
|2019.07.22|CBR Online| → [[IaaS Magic Quadrant: Gartner Gets the Claws Out|https://www.cbronline.com/news/cloud-iaas-gartner]]|Gartner IaaS|
|2019.07.16|//Securosis//|[[Build Your Own Multi-Cloud Security Monitoring in 30 Minutes or Less with StreamAlert|https://disruptops.com/build-your-own-multi-cloud-security-monitoring-in-30-minutes-or-less-with-streamalert/]]|Monitoring|
|2019.07.16|//Duo Security//|[[Dragged Into the Light: Duo Security Report Reveals Businesses Gaining Control of Shadow IT|https://duo.com/about/press/releases/dragged-into-the-light-duo-security-report-reveals-businesses-gaining-control-of-shadow-it]]|Report DuoSecurity|
|2019.07.16|Dark Reading| → [[Security Snapshot: OS, Authentication, Browser & Cloud Trends|https://www.darkreading.com/cloud/security-snapshot-os-authentication-browser-and-cloud-trends/d/d-id/1335262]]|Report DuoSecurity|
|2019.07.16|//BlackBlaze//|[[More From Our Annual Survey: Choosing the Best Cloud for Backing Up|https://www.backblaze.com/blog/choosing-the-best-cloud-for-backing-up/]]|Report BlackBlaze|
|2019.07.16|//Rhino Security Labs//|[[Exploring the Power of Phished Persistent Cookies in AWS|https://rhinosecuritylabs.com/aws/aws-phished-persistent-cookies/]]|AWS|
|2019.07.16|//Zscaler//|[[Abusing Microsoft's Azure domains to host phishing attacks|https://www.zscaler.com/blogs/research/abusing-microsofts-azure-domains-host-phishing-attacks]]|Azure Phishing|
|2019.07.16|//G2//|[[11 Myths About Cloud Storage: Debunked|https://learn.g2.com/cloud-storage]]|Storage|
|2019.07.16|//PaloAlto Networks//|[[Seven Guiding Principles to Selecting the Right Cloud Security Solution|https://blog.paloaltonetworks.com/2019/07/seven-guiding-principles-selecting-right-cloud-security-solution/]]|Misc|
|2019.07.16|//ThreatStack//|![[16 Cloud Security Experts Share the Most Costly Security Technology Misconceptions When It Comes to Cloud Migration|https://www.threatstack.com/blog/16-cloud-security-experts-share-the-most-costly-security-technology-misconceptions-when-it-comes-to-cloud-migration]]|Migration|
|2019.07.16|//Datanami//|[[The State of Storage: Cloud, IoT, and Data Center Trends|https://www.datanami.com/2019/07/16/the-state-of-storage-cloud-iot-and-data-center-trends/]]|Storage|
|2019.07.16|Silicon Angle|[[8M lines of hotel-related code exposed in latest Elasticsearch database configuration failure|https://siliconangle.com/2019/07/16/8m-hotel-records-exposed-latest-elasticsearch-database-configuration-fail/]]|Data_Leaks|
|2019.07.16|//Security Intelligence//|[[The Fine Art of Protecting Microsoft Office 365 Apps With Multifactor Authentication|https://securityintelligence.com/posts/the-fine-art-of-protecting-microsoft-office-365-apps-with-multifactor-authentication/]]|O365 MFA|
|2019.07.16|//Managed Methods//|[[What Is Cloud Application Security?|https://managedmethods.com/blog/what-is-cloud-application-security/]]|Misc|
|2019.07.16|//Cruise//|[[Container Platform Security at Cruise (2/2)|https://medium.com/cruise/container-platform-security-7a3057a27663]]|Containers|
|2019.07.16|//Radware//|[[Have Crypto-Miners Infiltrated Your Public Cloud?|https://blog.radware.com/security/cloudsecurity/2019/07/have-crypto-miners-infiltrated-your-public-cloud/]]|Cryptomining|
|>|>|>|!2019.07.15|
|2019.07.15|Cloud Native Computing Foundation|[[Demystifying Containers - Part II: Container Runtimes|https://www.cncf.io/blog/2019/07/15/demystifying-containers-part-ii-container-runtimes/]]|Containers|
|2019.07.15|8 Bit Men|[[A Thorough Guide to High Availability, HA Cluster Architecture & Fault Tolerance|https://www.8bitmen.com/a-simple-guide-to-high-availability-ha-cluster-architecture-fault-tolerance/]]|Fault_Tolerance|
|2019.07.15|8 Bit Men|![[A Super Helpful Guide to Understanding Workload & It's Types in Cloud|https://www.8bitmen.com/a-super-helpful-guide-to-understanding-workload-its-types-in-cloud/]]|Workloads|
|2019.07.15|8 Bit Men|![[AWhat Is an Instance In Cloud Computing? – A Thorough Guide|https://www.8bitmen.com/what-is-an-instance-in-cloud-computing-a-thorough-guide/]]|Instances|
|2019.07.15|//Alcide//|[[New Analysis by Alcide Finds 89% of Kubernetes Deployments Not Leveraging Secrets Resources|https://containerjournal.com/2019/07/15/new-analysis-by-alcide-finds-89-of-kubernetes-deployments-not-leveraging-secrets-resources/]]|Kubernetes|
|2019.07.15|//AlienVault//|[[Cloud Security and Risk Mitigation|https://www.alienvault.com/blogs/security-essentials/cloud-security-and-risk-mitigation]]|Risks Mitigation|
|2019.07.15|//Lacework//|[[Cloud Compliance Security, Part 2: The Importance of Security Controls (2/2)|https://www.lacework.com/cloud-compliance-security-part-2-importance-security-controls/]]|Compliance|
|2019.07.15|//TrendMicro//|[[SLUB Gets Rid of GitHub, Intensifies Slack Use|https://blog.trendmicro.com/trendlabs-security-intelligence/slub-gets-rid-of-github-intensifies-slack-use/]]|Attacks Slack|
|2019.07.15|//Azure//|![[Advancing Microsoft Azure reliability|https://azure.microsoft.com/en-gb/blog/advancing-microsoft-azure-reliability/]]|Azure Reliability|
|2019.07.15|//Outpost24//|[[Infosecurity Europe 2019 infographic: Cyber resilience for application and cloud security|https://outpost24.com/blog/Infosecurity-Europe-2019-infographic-Cyber-resilience-for-application-and-cloud-security]]|Resilience|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Juillet 2019]]>>
!"//Signal vs. Noise: Banker Cloud Stories//"
[>img(150px,auto)[iCSA/J7JBS.jpg]]Article de blog publié le 19 juillet 2019 — Rédigé par Craig Balding
<<<
//Une bonne question à poser à un professionnel, quelque soit son secteur d'activité est : à quels événements professionnels participez-vous et pourquoi ?
En plusieurs décennies, j'ai participé et fait l'impasse sur beaucoup d'entre eux, mon principal critère de choix étant le rapport "signal/bruit". En d'autres termes, je sélectionne des événements auxquels assistent des personnes qui façonnent notre industrie — visionnaires, expérimentateurs de premier plan, décideurs, et bien sûr des ceux qui ont une réelle expérience "terrain". Evitez les "moulins à parole" et recherchez les "retours d'expérience".// [...]
//En juin, 23 membres de notre groupe de travail CSA du secteur de la finance s'est réuni dans la belle ville de Louvain, en Belgique, où nous avons passé la journée à partager nos expériences et à discuter des pratiques émergentes, en appliquant la règle de Chatham House.

''Les thèmes abordés''
La journée comprenait des présentations de haute volée, puis du réseautage. Chaque présentation de 10 minutes servait de point de départ à des séances de questions / réponses pointues de 10 minutes aussi.// [...]

//''Et la suite ?''
Nos prochains thèmes seront : la sécurité des containers; comprendre la complexité du Cloud compte-tenu des scénarios d'adoption eux aussi toujours plus complexes; transformations et agilité dans le secteur financier.// [...]
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/19/signal-vs-noise-banker-cloud-stories-by-craig-balding/]] sur le blog de la CSA
!"//'Shift Left' to Harden Your Cloud Security Posture//"
[>img(150px,auto)[iCSA/J7IBS.jpg]]Article de blog publié le 18 juillet 2019 — Rédigé par Josh Stella, Co-founder & Chief Technology Officer, Fugue
<<<
//After a decade-long uneasy courtship with cloud computing, enterprises are migrating their IT systems to platforms like AWS and Azure as fast as they can. This means the key question for the security team is no longer "do we trust the cloud?" -- it's "can we trust ourselves in the cloud?" Answering "yes" requires embracing a term common in application developers circles: "Shift Left". Just as developers unit test their application code prior to merging into the build, they should also implement automated unit security testing of their modules prior to merging into the stage environment.

''Small errors create big problems''
If you've been running in the cloud at scale, you're familiar with the challenge of trying to constantly monitor for the security risks created by resources without known owners, misconfigurations, and humans making errors like leaving too much access after a maintenance event. Human error is the number one cause of data breaches in the cloud, primarily due to the misconfiguration of cloud infrastructure.
Asking the security team to monitor and address misconfigurations in real-time is asking them to tilt at windmills. They quickly become overwhelmed by alerts and struggle to keep up with manual remediation or an ever-growing bag of bespoke automated remediation scripts. The all-too-common result is that the organization finds its brand name and reputation splashed across news headlines and articles about data exposure or loss due to a cloud misconfiguration.

''Security and compliance shift left''
Among developers, the term "shift left" describes moving a particular function to earlier phases of their processes to make identifying and fixing bugs and other errors easier and less time-consuming. The longer they wait, the more difficult making a fix becomes, and that creates delays.
Developers typically relegate security and compliance considerations as afterthoughts implemented as a gate during the test phase. Then they grow frustrated when red flags go up that force them to perform rework in design, development, and testing, and blame the security team for delays moving applications into production.
Automating the shift left of compliance and security into the design and develop phases will eliminate those delays and frustrations, make better systems, and turn those functions into highway builders rather than toll booth operators.

''Establish universal policy interpretations and secure baselines''
This isn't just a process change, it's a culture change. Organizations will likely need to get their security, DevOps and compliance teams to commit to establishing trust and confidence with one another. The best way to accomplish this is to have a "contract" between the teams in the form of actual code that includes explicit and shared interpretations of policy and establishes a baseline of the environment that is enforced via automated tools and processes all the way through the software development lifecycle (SDLC).
A baseline is a complete configuration of an application from the infrastructure up. Baselining allows all stakeholders to determine if the configuration is acceptable early in the process. Developers need to make sure the system functions as intended. Operations needs to know that the system is reliable and maintainable. Security needs to know that it is configured in conformance with best practices and policies at deployment and during operations, and compliance needs to know that it meets audit and/or regulatory controls.
By establishing a definition of known-good into the design and development phases, all parties can come to an agreement early in the process and work together to avoid costly delays. The term "DevSecOps" is becoming more popular as security and DevOps realize they need to come together to address security and compliance considerations earlier in the development process. Creating and enforcing a known-good baseline provides developers with real-time automated feedback through the design and develop phases so they avoid interrupts that breed delays and ensure that the production environment meets all security and compliance policies when deployed to the cloud.//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/18/shift-left-to-harden-your-cloud-security-posture/]] sur le blog de la CSA
Cet article est la consolidation de 3 articles publiés sur le site de la société Fugue, déjà mentionnés dans la veille hebdomadaire+++*[»]>
|2019.04.17|//Fugue//|[[Shifting Left on Cloud Security and Compliance|https://www.fugue.co/blog/shifting-left-on-cloud-security-and-compliance]] (1/3)|Risks|
|2019.05.24|//Fugue//|[[Shift Left on Cloud Security, Part II - Phases of the SDLC|https://www.fugue.co/blog/shift-left-on-cloud-security-part-ii-phases-of-the-sdlc]] (2/3)|Risks|
|2019.06.27|//Fugue//|[[Shift Left on Cloud Security, Part III: Extending into Production|https://www.fugue.co/blog/shift-left-on-cloud-security-part-iii-extending-into-production]] (3/3)|Risks|
=== 
Communiqué de presse du 16 juillet 2019
<<<
//Report identifies challenges in securing application containers and microservices through the lens of the developer, operator and architect
[>img(150px,auto)[iCSA/J7GPC.png]]SEATTLE - July 16, 2019 - The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today released the Challenges in Securing Application Containers and Microservices. Produced by the CSA's Application Containers and Microservices Working Group, this report examines and prioritizes the challenges application architects, developers and operators will encounter when designing, deploying and operating secure application containers and microservices. It is the first in a series of reports that will cover best practices to address and help mitigate the challenges for app containers and microservices outlined in this document, as well as delineating a unified standard for microservices architecture.

"Application containers and microservices have specific characteristics that come with distinct security ramifications," said Anil Karmel, Application Container and Microservices Working Group Co-chair. "By prioritizing various challenges surrounding the securing of application containers and microservices and separating them into use case and feature categories, those involved in the software development lifecycle will be able to make informed security decisions."

Challenges were scored based on 10 weighted questions as applied against application container and microservices features. The top three challenges surrounding application containers were identified as:
* The use of monitoring and security solutions in multi-tenant hosting environments that do not require root or "privileged" access to the container host. These solutions are specifically designed to expose information from more than one tenant and their compromise could result in information spillage or system compromise.
* Ensuring trust in host systems that store images and launch containers. The absence of host-hardening processes can result in the compromise of images, runtime environments and stored data.
* Host hardening is an important requirement for secure container hosting, and a challenge exists to ensure that hardening doesn't interfere with authorized capabilities (e.g., network, storage) of the containers themselves. The absence can result in service availability issues.

The three most critical issues pertaining to microservices challenges were identified as:
* Finding a balance between the costs and benefits of rebuilding a microservice architecture and then orchestrating those microservices. The absence will result in either cost overruns or an application that does not fully benefit from a microservice architecture.
* A container's lifespan when architecting stateful microservices. Care must be taken to design a microservice that does not lose state when a container is no longer running as its absence can result in data loss.
* Ensuring interoperability when writing or maintaining a microservice that interfaces with several other microservices. Reliable test harnesses are required and their absence can result in increased availability and performance issues as the application is decomposed into microservices.
//
<<<
* +++*[Détails complémentaires »]> <<tiddler [[2019.07.16 - Publication : 'Best Practices for Implementing a Secure Application Container Architecture']]>>=== 
* &rArr; Lire [[la suite|https://cloudsecurityalliance.org/articles/csa-releases-new-research-indentifying-challenges-in-securing-application-containers-and-microservices/]] sur le site de la CSA
!"//Challenges in Securing Application Containers and Microservices//"
<<<
[>img(150px,auto)[iCSA/J7GPC.png]]//Application containers and a microservices architecture are being used to design, develop and deploy applications leveraging agile software development approaches such as Development Operations. Security must be embedded into these software development approaches. This document serves to identify challenges in securing application containers and microservices in the engineering of trustworthy secure systems through the lens of the Developer, Operator and Architect.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j7gc/|https://CloudSecurityAlliance.fr/go/j7gc/]]''





!1 - Les nouveautés CSA de la semaine du 8 au 14 juillet 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Inscription au Mastère Spécialisé de l'ISEP "Expert Cloud Computing"''+++*[»]> <<tiddler [[2019.07.08 - Blog : Inscription au Mastère Spécialisé de l'ISEP 'Expert Cloud Computing']]>>=== 
* Actualités : ''Cloud Security Alliance Releases Cloud Penetration Testing Playbook''+++*[»]> <<tiddler [[2019.07.12 - Actu : 'CSA Releases Cloud Penetration Testing Playbook']]>>=== 
* Publication : ''Cloud Penetration Testing Playbook''+++*[»]> <<tiddler [[2019.07.12 - Publication : 'Cloud Penetration Testing Playbook']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.07.14 - Veille Hebdomadaire]] avec une soixantaine de liens :
* Piratages et fuites de données : Magecart et les attaques systématiques contre les buckets Amazon S3 mal configurés
* Rapports et sondages : Blueprint d'architecture Cloud sécurisée par le Global Cities Team Challenge, sondages Netwrix et Gemalto
* Pannes : Twitter
* Divers : Protection des données dans des buckets AWS, Docker, Kubernetes
!3 - Agenda
* ''28 __juillet__'' : ''derniers jours'' avant la clôture de l'appel à présentations pour le ''CSA Congress EMEA'' des 20 et 21 novembre 2019 à Berlin+++*[»]> <<tiddler [[2019.06.21 - Actu : Encore un mois pour soumettre un sujet au CSA Congress EMEA 2019]]>>=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Juillet|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.07.14|
|2019.07.14|BetaNews|[[Planning a cloud migration? Get your identity privileges in check first|https://betanews.com/2019/07/14/planning-a-cloud-migration-get-your-identity-privileges-in-check-first/]]|Identity|
|2019.07.14|//HiveMQ//|[[The lightweight IoT Protocol MQTT: How to get started|https://www.hivemq.com/blog/how-to-get-started-with-mqtt/]]|MQTT|
|>|>|>|!2019.07.12|
|2019.07.12|RTS[>img[iCSF/flag_fr.png]]|[[Swisscom a effacé les données de centaines de clients MyCloud|https://www.rts.ch/info/suisse/10569711-swisscom-a-efface-les-donnees-de-centaines-de-clients-mycloud.html]]|Outage Swisscom|
|2019.07.12|EDPB / EDPS|![[LIBE Committee letters to the EDPS and to the EDPB regarding legal assessment of the impact of the US Cloud Act on the European legal framework for personal data protection (pdf)|https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_edps_joint_response_us_cloudact_coverletter.pdf]]|CLOUD_Act|
|2019.07.12|HelpNet Security|![[How businesses can become more nimble and secure by moving to the cloud|https://www.helpnetsecurity.com/2019/07/12/becoming-secure-cloud-adoption/]] |Misc|
|2019.07.12|DZone|[[4 Ways to Cut Costs When Backing up VMs in The Cloud|https://dzone.com/articles/4-ways-to-cut-costs-when-backing-up-vms-in-the-clo]]|VMs|
|2019.07.12|Cyber Defense Mag|[[US Agency Security Doubts Hinder Move To Hybrid Cloud|https://www.cyberdefensemagazine.com/us-agency-security-doubts-hinder-move-to-hybrid-cloud/]]|Hybrid_Cloud|
|2019.07.12|FinExtra|[[How to build the regulator's confidence in the cloud|https://www.finextra.com/newsarticle/34114/how-to-build-the-regulators-confidence-in-the-cloud]]|Compliance|
|2019.07.12|Cyware|[[DNA Testing Company Vitagene Exposed Over 3,000 Patient Records Due to Misconfigured Database|https://cyware.com/news/dna-testing-company-vitagene-exposed-over-3000-patient-records-due-to-misconfigured-database-cb415557]]|AWS Data_Leak|
|2019.07.12|CloudTech|[[How public cloud continues to drive demand for cybersecurity solutions|https://www.cloudcomputing-news.net/news/2019/jul/12/public-cloud-drives-demand-for-cybersecurity-solutions/]]|Solutions|
|2019.07.12|safecontrols|![[Securing media stored in cloud storage buckets against unauthorised access|https://safecontrols.blog/2019/07/12/securing-media-stored-in-cloud-storage-buckets-against-unauthorised-access/]] |AWS Storage|
|2019.07.12|//Cloudflare//|![[Details of the Cloudflare outage on July 2, 2019|https://blog.cloudflare.com/details-of-the-cloudflare-outage-on-july-2-2019/]] |Outage Cloudflare|
|2019.07.12|//Forcepoint//|[[Prioritizing cloud security initiatives|https://www.forcepoint.com/blog/insights/prioritizing-cloud-security-initiatives]]|Misc|
|2019.07.12|//Lacework//|[[Cloud Compliance Security, Part 1: Understanding Expectations & Building Requirements (1/2)|https://www.lacework.com/cloud-compliance-security-part-1-expectations-requirements/]]|Compliance|
|2019.07.12|//AlertLogic//|[[Five Insights from and About the First AWS re:Inforce|https://blog.alertlogic.com/five-insights-from-and-about-the-first-aws-reinforce/]]|AWS Conference|
|2019.07.12|//DeltaRisk//|[[Federal Agencies Moving to the Cloud Must Take Stock of Information Systems|https://deltarisk.com/blog/federal-agencies-moving-to-the-cloud-must-take-stock-of-information-systems/]]|Strategy|
|>|>|>|!2019.07.11|
|2019.07.11|GeekWire|[['Something is technically wrong': Twitter outage extends beyond an hour|https://www.geekwire.com/2019/something-technically-wrong-twitter-outage-extends-beyond-hour/]]|Outage Twitter|
|2019.07.11|Dark Reading|[[The Security of Cloud Applications|https://www.darkreading.com/cloud/the-security-of-cloud-applications-/a/d-id/1335157]]|Misc|
|2019.07.11|CSO|[[How a decentralized cloud model may increase security, privacy|https://www.csoonline.com/article/3405439/how-a-decentralized-cloud-model-may-increase-security-privacy.html]]|Architecture|
|2019.07.11|DZone|[[Understanding Docker Networking|https://dzone.com/articles/understanding-docker-networking]]|Docker|
|2019.07.11|DZone|[[Updating and Modernizing: Moving from Virtual Machines to Containers|https://dzone.com/articles/updating-and-modernizing-moving-from-virtual-machi]]|VMs Containers|
|2019.07.11|DZone|[[Kubernetes vs OpenShift: What Is the Difference?|https://dzone.com/articles/kubernetes-vs-openshift-what-is-the-difference]]|Kubernetes OpenShift|
|2019.07.11|//Fugue//|![[5 Things Executives Need to Know About Cloud Security|https://www.fugue.co/blog/5-things-executives-need-to-know-about-cloud-security]] |Best_Practices|
|2019.07.11|//PaloAlto Networks//|[[How Western Asset Management Is Mitigating Cloud Threats|https://blog.paloaltonetworks.com/2019/07/western-asset-management-mitigating-cloud-threats/]]|Threats Mitigation|
|2019.07.11|//TrendMicro//|[[Migrating Network Protection to the Cloud with Confidence|https://blog.trendmicro.com/migrating-network-protection-to-the-cloud-with-confidence/]]|Protection|
|2019.07.11|//Microsoft//|[[Authentication Methods–Usage & Insights|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Authentication-Methods-Usage-amp-Insights/ba-p/745370]]|ActiveDirectory|
|2019.07.11|//TAG Cyber//|[[Cloud Security for the Masses|https://threatvector.cylance.com/en_us/home/cloud-security-for-the-masses.html]]|Misc|
|2019.07.11|//Forcepoint//|[[Cloud app security in a direct-to-cloud world|https://www.forcepoint.com/blog/insights/cloud-app-security-direct-cloud-world]]|Misc|
|2019.07.11|//Whistic//|[[Phase 5 of The 5 Phases of Responding to a Security Questionnaire & How To Get Proactive (5/5)|https://blog.whistic.com/phase-5-of-the-5-phases-of-responding-to-a-security-questionnaire-how-to-get-proactive-19421dbac65]]|Misc|
|2019.07.11|//Managed Methods//|[[3 Critical Microsoft Cloud Security Issues|https://managedmethods.com/blog/3-critical-microsoft-cloud-security-issues/]]|Azure O365|
|>|>|>|!2019.07.10|
|2019.07.10|Journal du Net[>img[iCSF/flag_fr.png]]|[[Multi-cloud : comment assurer la disponibilité des données ?|https://www.journaldunet.com/solutions/expert/71422/multi-cloud---comment-assurer-la-disponibilite-des-donnees.shtml]]|MultiCloud|
|2019.07.10|GCTC|"Secure Cloud Architecture: Towards a Smart City cloud privacy, Security, and Rights-Inclusive Architecture" ([[blueprint|https://gctc.opencommons.org/images/f/ff/CommunityCloudPrivacy.pdf]])|Architecture|
|2019.07.11|GCN| → [[A secure cloud architecture for smart cities|https://gcn.com/articles/2019/07/11/smart-city-secure-cloud-architecture.aspx]]|Architecture|
|2019.07.10|Container Journal|[[Inside the Canonical Container Strategy|https://containerjournal.com/2019/07/10/inside-the-canonical-container-strategy/]]|Containers|
|2019.07.10|BetaNews|[[Is your online cloud storage secure enough?|https://betanews.com/2019/07/10/online-cloud-storage-secure-enough/]]|Storage|
|2019.07.10|DZone|[[Sending Custom Application Stats From EC2 Server to CloudWatch for Monitoring|https://dzone.com/articles/sending-custom-application-stats-from-ec2-for-clou]]|Monitoring|
|2019.07.10|KitPloit|[[Cloud Security Audit - A Command Line Security Audit Tool For Amazon Web Services|https://www.kitploit.com/2019/07/cloud-security-audit-command-line.html]]|Audit Tools|
|2019.07.10|//RiskIQ//|[[Spray and Pray: Magecart Campaign Breaches Websites En Masse Via Misconfigured Amazon S3 Buckets|https://www.riskiq.com/blog/labs/magecart-amazon-s3-buckets/]]|AWS Attacks Magecart|
|2019.07.11|Wired| → [[Hack Brief: A Card-Skimming Hacker Group Hit 17K Domains - and Counting|https://www.wired.com/story/magecart-amazon-cloud-hacks/]]|AWS Attacks Magecart|
|2019.07.11|CBR Online| → [[Magecart Launches "Spray and Pray" Attacks on AWS S3 Buckets, Hits 17,000|https://www.cbronline.com/news/magecart-aws-s3-card-skimmers]]|AWS Attacks Magecart|
|2019.07.11|infoRisk Today| → [[RiskIQ: Magecart Group Targeting Unsecured AWS S3 Buckets|https://www.inforisktoday.com/riskiq-magecart-group-targeting-unsecured-aws-s3-buckets-a-12771]]|AWS Attacks Magecart|
|2019.07.12|Bleeping Computer| → [[Over 17,000 Domains Infected with Code that Steals Card Data|https://www.bleepingcomputer.com/news/security/over-17-000-domains-infected-with-code-that-steals-card-data/]]|AWS Attacks Magecart|
|2019.07.12|ComputerWeekly| → [[Magecart Hackers Infect 17,000 Domains via Insecure S3 Buckets|https://www.securityweek.com/magecart-hackers-infect-17000-domains-insecure-s3-buckets]]|AWS Attacks Magecart|
|2019.07.12|The Register| → [[When did you last check your AWS S3 security? Here's four scary words: 17k Magecart infections|https://www.theregister.co.uk/2019/07/12/riskiq_magecart_s3/]]|AWS Attacks Magecart|
|2019.07.17|//DivvyCloud//| → [[Hacker Group "Magecart" Attacking Misconfigured S3 Buckets|https://divvycloud.com/blog/protect-your-s3-buckets-from-magecart/]]|AWS Attacks Magecart|
|2019.07.10|//AlienVault//|[[What is Chaos Engineering in penetration testing?|https://www.alienvault.com/blogs/security-essentials/what-is-chaos-engineering-in-pen-testing]]|PenTesting Chaos_Engineering|
|2019.07.10|//Avanan//|[[Watch Out for HTML Attachments, the Latest Phishing Trend Targeting Office 365|https://www.avanan.com/resources/phishing-trend-targeting-office-365-uses-html-attachments]]|Phishing O365|
|>|>|>|!2019.07.09|
|2019.07.09|Dark Reading|![[Cloud Security and Risk Mitigation|https://www.darkreading.com/perimeter/cloud-security-and-risk-mitigation/a/d-id/1335100]] |Risks Mitigation|
|2019.07.09|Container Journal|[[Building Secure Production-Ready Kubernetes Clusters and Containers (2/2)|https://containerjournal.com/2019/07/09/building-secure-production-ready-kubernetes-clusters-and-containers-part-2/]]|Containers|
|2019.07.09|DZone|[[Top Issues Facing Internet of Medical Things and How to Solve Them|https://dzone.com/articles/main-issues-of-internet-of-medical-things-and-how]]|Medical IoT|
|2019.07.09|DZone|[[Deconstructing Serverless Computing Part 4: Developing to Infinity and Beyond!|https://dzone.com/articles/deconstructing-serverless-computing-part-4-develop]]|Serverless|
|2019.07.09|//Stackrox//|[[Gartner: How-To Guide on Securing Containers|https://www.stackrox.com/post/2019/07/gartner-how-to-guide-on-securing-containers/]] (3/3)|Containers|
|2019.07.09|//BlackBlaze//|[[More People Than Ever Backing Up According to Our Survey|https://www.backblaze.com/blog/more-people-than-ever-backing-up-according-to-our-survey/]]|Report BlackBlaze|
|2019.07.09|//Sysdig//|![[33 Kubernetes security tools|https://sysdig.com/blog/33-kubernetes-security-tools/]] |Kubernetes|
|2019.07.09|//Microsoft//|[[Your Pa$$word doesn't matter|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Your-Pa-word-doesn-t-matter/ba-p/731984]]|Authentication|
|2019.07.09|//Symantec//|[[Why a CASB is Essential to any Cloud and Enterprise Security Strategy|https://www.symantec.com/blogs/product-insights/why-casb-essential-any-cloud-and-enterprise-security-strategy]]|CASB|
|2019.07.09|//Avanan//|[[Cloud Email Security Supplements Address SaaS Vulnerabilities|https://www.avanan.com/resources/cloud-email-security-supplements-address-saas-vulnerabilities]]|SaaS|
|2019.07.09|//Rapid7//|[[Securing Your Cloud Environments with InsightIDR, Part 2: Amazon Web Services (AWS)|https://blog.rapid7.com/2019/07/09/securing-your-cloud-environments-with-insightidr-part-2-amazon-web-services-aws/]] (2/3)|AWS|
|2019.07.09|//Alibaba//|[[DevOps: How to Have Less Downtime|https://medium.com/@Alibaba_Cloud/devops-how-to-have-less-downtime-c04f630160f2]]|DevOps Availability|
|2019.07.09|//Alibaba//|[[Building An Immutable Cloud Infrastructure On Alibaba Cloud|https://medium.com/@Alibaba_Cloud/building-an-immutable-cloud-infrastructure-on-alibaba-cloud-b49ac03923c8]]|Availability|
|2019.07.09|//Netwrix//|[[Netwrix survey: 32% of healthcare organizations store all their sensitive data in the cloud, yet lack the resources to protect it|https://www.netwrix.com/netwrix_survey_32_percent_of_healthcare_organizations_store_all_their_sensitive_data_in_the_cloud.html]] ([[rapport|http://www.netwrix.com/go/cloudsecurity2019_healthcare]])|Report|
|2019.07.09|//Blissfully//|[[Five Important Questions To Ask About Your Business's SaaS Tools|https://www.blissfully.com/blog/five-questions-businesss-saas-tools/]]|SaaS|
|2019.07.09|//Sysdig//|[[How to detect Kubernetes vulnerability CVE-2019-11246 using Falco|https://sysdig.com/blog/how-to-detect-kubernetes-vulnerability-cve-2019-11246-using-falco/]]|CVE-2019-11246 Kubernetes|
|2019.07.09|//Managed Methods//|[[Everything You Need to Know About Office 365 Cloud App Security|https://managedmethods.com/blog/office-365-cloud-app-security/]]|Azure O365|
|2019.07.09|//Symantec//|[[Containing Your Containers - It's Time to Batten Down the Hatches|https://www.symantec.com/blogs/product-insights/containing-your-containers-its-time-batten-down-hatches]]|Containers|
|2019.07.09|//CCSI//|[[Cloud Audit Protection Against Security Threats|https://www.ccsinet.com/blog/cloud-security-audit/]]|Auditing|
|2019.07.09|//Sysdig//|![[33(+) Kubernetes security tools|https://sysdig.com/blog/33-kubernetes-security-tools/]]|Kubernetes Tools|
|>|>|>|!2019.07.08|
|2019.07.08|!CSA|[[Organizations Must Realign to Face New Cloud Realities|https://www.symantec.com/blogs/feature-stories/organizations-must-realign-face-new-cloud-realities]] |CSA JimReavis|
|2019.07.08|//eXemplify//|[[Steps to Improved Cloud Security|http://www.exemplifygroup.com/steps-to-improved-cloud-security/]]|Misc|
|2019.07.08|//Gemalto//|[[Study: 49% of ITDMs Feel Cloud Apps Are the Biggest Targets of Digital Threats|https://blog.gemalto.com/security/2019/07/08/study-49-of-itdms-feel-cloud-apps-are-the-biggest-targets-of-digital-threats/]] ([[rapport|https://safenet.gemalto.com/access-management-index/]])|Report Gemalto|
|2019.07.08|ComputerWeekly| → [[Nearly half of firms fear cloud apps make them insecure|https://www.computerweekly.com/news/252466371/Nearly-half-firms-fear-cloud-apps-make-them-insecure]]|Report Gemalto|
|2019.07.09|Dark Reading| → [[Organizations Are Adapting Authentication for Cloud Applications|https://www.darkreading.com/cloud/organizations-are-adapting-authentication-for-cloud-applications/d/d-id/1335200]]|Authentiction|
|2019.07.10|HelpNet Security| → [[Do cloud apps make you a target for cyber attacks?|https://www.helpnetsecurity.com/2019/07/10/cloud-apps-cyber-attacks/]]|Report Gemalto|
|2019.07.08|//StorageCraft//|[[Will Brexit Affect StorageCraft's Cloud Products?|https://blog.storagecraft.com/will-brexit-affect-storagecrafts-cloud-products/]]|Brexit|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Juillet 2019]]>>
Communiqué de presse du 12 juillet 2019
<<<
//Reports provides foundation for public cloud penetration testing methodology
[>img(150px,auto)[iCSA/j7CPC.png]]SEATTLE - July 12, 2019 - The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today released the Cloud Penetration Testing Playbook. Developed by the CSA Top Threats Working Group, the playbook addresses the methodological and knowledge gaps in the security testing of information systems and applications in public cloud environments with a focus on penetration testing of cloud-hosted applications and services. By providing advice on key topics the report aims to help mature cloud penetration testing and, in the process, create a more secure cloud computing environment.

The playbook represents a collective effort to provide guidance for the penetration testing of systems in public cloud environments and allows penetration testers to use the document's objectives to test the security of public cloud systems and environments. It also touches legal and other associated concerns, aiming to educate key decision makers on the complexities of penetration testing in a multi-stakeholder, layered information technology stack.

"As cloud services become ever more integral to critical business capabilities, as well as foundational for many cloud-native businesses, it is past time we lift the veil on offensive cloud security and testing. In this publication, some of world's leading cloud security experts and CSA proudly deliver this exclusive knowledge from the domain of the skilled few to the benefit of everyone," said Alexander Getsin, lead author and industry cyber security architect.

The CSA Top Threats Working Group, co-chaired by Jon-Michael Brook, principal contributor in the industry and CSA Research Fellow, was established to provide organizations with an up-to-date, expert-informed understanding of cloud security risks, threats and vulnerabilities in order to make educated risk-management decisions regarding cloud adoption strategies. Individuals interested in becoming involved in the future research and initiatives of this group are invited to do so by visiting the Join page.//
<<<
* +++*[Détails complémentaires »]> <<tiddler [[2019.07.12 - Publication : 'Cloud Penetration Testing Playbook']]>>=== 
* &rArr; Lire [[la suite|https://cloudsecurityalliance.org/articles/cloud-security-alliance-releases-cloud-penetration-testing-playbook/]] sur le site de la CSA
!"//Cloud Penetration Testing Playbook//"
<<<
[>img(150px,auto)[iCSA/j7CPC.png]]//This work focuses on testing systems and services hosted in public cloud environments. This refers to customer-controlled or customer-managed systems and services. For example, a custom virtual machine, managed and controlled by the cloud customer, in an IaaS environment would be in-scope whereas the hypervisor of an IaaS environment that is controlled by the cloud service provider isn't. As for testing hybrid clouds, this document does not cover the hybrid interface and on-premises environment.//
<<<
__Table des Matières :__
<<<
# Introduction
** Target Audience
# Scope of this Document
# Cloud Penetration Testing Scope
# Cloud Penetration Testing in Context
# Cloud Penetration Testing Objectives
# Cloud Penetration Test Cases and Concerns
## Preparation
## Threat Modelling
## Reconnaissance and Research
## Testing
## Report
# Legal
# Training and Resources
# Conclusions
# References
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j7cp/|https://cloudsecurityalliance.fr/go/j7cp/]]''
!Le Mastère Spécialisé® de l'ISEP "Expert Cloud Computing" existe depuis 7ans
[>img(150px,auto)[iCSF/ISEP-FC.jpg]]Le Cloud Computing ne fait pas que modifier la façon de consommer l'informatique, il change aussi les métiers au sein des DSI Directions des Services Informatiques. Bien que l'informatique dématérialisée ne s'appuie pas sur des avancées technologiques, elle n'a rien d'un effet de mode ni d'une simple évolution.

Depuis 7 ans, le Cloud Computing a profondément muri et les besoins de compétence des entreprises s'orientent de plus en plus vers les offres SaaS (Software-as-a-Service) dans leur évolution vers la digitalisation et les transformations métiers que cela génère.

[>img(700px,auto)[iCSF/J78PAMDLSDBDE.png]]Depuis 7 ans le Mastère Spécialisé® ''Expert Cloud Computing'' a évolué dans son contenu pour prendre en compte les évolutions des besoins en compétence dans les transformations des entreprises en intégrant les nouveautés technologiques (Internet des Objets, Bigdata, Intelligence Artificielle, Blockchain) de façon à coller aux besoins de l'instant dans la formation.

Le shéma ci-contre résume le positionnement actuel de ce Mastère Spécialisé® dans le spectre des besoins des entreprises.

Ce Mastère Spécialisé®, qui reste à dominante technique, prend en compte les besoins de nouvelles compétences des Ingénieurs non seulement liés au développement des nouvelles technologiques utilisant les ressources Cloud mais aussi de permettre aux lauréats du Mastère Spécialisé® de connaître et traiter les besoins des entreprises dans les domaines stratégiques tels que :
* la sécurité,
* la protection des données,
* les évolutions des Si d'entreprises en fonction des stratégies de transformations.

La pédagogie développée pour ce Mastère Spécialisé® fait toujours appel à la théorie madrée d'une forte proportion d'enseignements en liaison avec des projets opérationnels et concrets développant les qualités d'empathie et de travail en réseau des élèves.

__Planning :__
* Date de début de formation : jeudi 3 octobre 2019
* Date de fin de formation : vendredi 3 juillet 2020
* Soutenances de thèses : 17 ou 18 septembre 2020

__Labels & Accréditations :__
* Le Mastère Spécialisé® est ''labellisé par la CGE (Conférence des Grandes Ecoles) depuis 2012''.
* Le Mastère Spécialisé® est inscrit au ''RNCP (Registre National des Certifications Professionnelles)'' depuis janvier 2015 ; en conséquence, __il est éligible au financement par les OPCA et les Fongecif__
** Le Code RNCP du Mastère Spécialisé® est le [[21792|http://www.rncp.cncp.gouv.fr/grand-public/visualisationFiche?format=fr&fiche=21792]].
* Le Mastère Spécialisé® est éligible au compte personnel de formation(CPF), et peut être partiellement ou totalement financé.
** Le Mastère Spécialisé® est inscrit au CPF sous le n° 145653.
* Le Mastère Spécialisé® est inscrit au CNCP (Commission Nationale de la Certification Professionnelle).

__Liens :__
* Descriptif court du Mastère Spécialisé® ''Expert Cloud Computing''
** ⇒'' https://cloudsecurityalliance.fr/pdf/20190708-Descriptif-MS-CloudComputing-ISEP_2019-2020.pdf ''
* Descriptif détaillé du Mastère Spécialisé® ''Expert Cloud Computing'' sur le site ISEP Formation Continue
** ⇒ ''[[CloudSecurityAlliance.fr/go/McCC/|https://cloudsecurityalliance.fr/go/McCC/]]''

__Contacts et pour recevoir la documentation et le dossier d'inscription pour ce Mastère :__
* Mme Aïcha ABDAT, Assistante administrative ISEP Formation Continue
** Téléphone : 01 49 54 52 59
** Adresse : 10 rue de Vanves, 92130 Issy-les-Moulineaux
** email : ''&#8238;rf.pesi@tadba.ahcia&#8236;''
** Web : ''[[CloudSecurityAlliance.fr/go/McCC/|https://cloudsecurityalliance.fr/go/McCC/]]''
{{floatC{
<html><i class="fa fa-graduation-cap fa-3x" aria-hidden="true"></i><i class="fa fa-graduation-cap fa-3x" aria-hidden="true"></i><i class="fa fa-graduation-cap fa-3x" aria-hidden="true"></i><i class="fa fa-graduation-cap fa-3x" aria-hidden="true"></i><i class="fa fa-graduation-cap fa-3x" aria-hidden="true"></i><i class="fa fa-graduation-cap fa-3x" aria-hidden="true"></i></html>@@color:#00F;<html><i class="fa fa-graduation-cap fa-3x" aria-hidden="true"></i></html>@@
}}}
!1 - Les nouveautés CSA de la semaine du 1^^er^^ au 7 juillet 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Le site de la Cloud Security Alliance a changé de look ! A découvrir ici → ''[[CloudSecurityAlliance.org|https://CloudSecurityAlliance.org]]'' —+++*[»]> <<tiddler [[2019.07.03 - Actu : Nouveau site Web pour la Cloud Security Alliance]] >>=== 
* Blog : "''Using The CAIQ-Lite to Assess Third Party Vendors''"+++*[»]> <<tiddler [[2019.07.01 - Blog : Utiliser CAIQ-Lite pour évaluer des prestataires ou fournisseurs]]>>=== 
* Blog : "''The State of SDP Survey: A Summary''"+++*[»]> <<tiddler [[2019.07.02 - Blog : Résultat du sondage SDP]]>>=== 
* Blog : "''Highlights from the CSA Summit at Cyberweek''"+++*[»]> <<tiddler [[2019.07.03 - Blog : Temps forts du CSA Summit à la Cyberweek]]>>=== 
* Appels à commentaires ''avant le 7 juillet 2019'' : "''Top Threats to Cloud Computing 2019''"+++*[»]> <<tiddler [[2019.06.11 - Actu : Appel à commentaires, document 'Top Threats to Cloud Computing 2019']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.07.07 - Veille Hebdomadaire]] avec une quarantaine de liens dont :
* Pannes : Tweetdeck et Cloudflare (la série noire), Facebook, Verizon
* Piratages et fuites de données : PCM (la suite)
* Conférences : retours sur ''AWS re:Inforce 2019''
* Rapports et sondages : Canalys
* Divers : incidents dans le Cloud et responsabilité, Kubernetes ...
!3 - Agenda
* ''28 __juillet__'' : clôture de l'appel à présentations pour le ''CSA Congress EMEA'' des 20 et 21 novembre 2019 à Berlin+++*[»]> <<tiddler [[2019.06.21 - Actu : Encore un mois pour soumettre un sujet au CSA Congress EMEA 2019]]>>=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Juillet|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.07.07|
|2019.07.07|Computer Weekly|[[Public sector should embrace multicloud to cut risk of cloud market monopolisation, says report|https://www.computerweekly.com/news/252466305/Public-sector-should-embrace-multicloud-to-cut-risk-of-cloud-market-monopolisation-says-report]]|Risks|
|2019.07.07|//Menlo Security//|[[Even Dropbox and Box aren't Safe|https://www.menlosecurity.com/blog/even-dropbox-and-box-arent-safe]]|Attacks Phishing|
|>|>|>|!2019.07.06|
|2019.07.06|Bleeping Computer|[[Beware of Fake Microsoft OneNote Audio Note Phishing Emails|https://www.bleepingcomputer.com/news/security/beware-of-fake-microsoft-onenote-audio-note-phishing-emails/]]|Phishing|
|2019.07.06|//eXemplify//|[[Tackling Cloud Security Challenges Before They Become a Crisis Situation|http://www.exemplifygroup.com/tackling-cloud-security-challenges-before-they-become-a-crisis-situation/]]|Incident_Handling|
|>|>|>|!2019.07.05|
|2019.07.05|LeMagIT[>img[iCSF/flag_fr.png]]|[[Les entreprises françaises adoptent le cloud, mais se soucient de leur souveraineté|https://www.lemagit.fr/actualites/252466306/Les-entreprises-francaises-adoptent-le-cloud-mais-se-soucient-de-leur-souverainete]]|Compliance|
|2019.07.05|ProPrivacy|[[How secure are Dropbox, OneDrive, Google Drive and iCloud?|https://proprivacy.com/guides/how-secure-is-cloud-storage]]|DataPrivacy|
|2019.07.05|ZDnet|[[Encryption laws are creating an exodus of data from Australia: Vault|https://www.zdnet.com/article/encryption-laws-are-creating-an-exodus-of-data-from-australia-vault/]]|Encryption|
|2019.07.05|Infosec Write-Ups|[[Using Shodan Better Way! :)|https://medium.com/bugbountywriteup/using-shodan-better-way-b40f330e45f6]]|Detection|
|2019.07.05|SecTor|[[Why Cloud Data Exposures Keep Happening|https://sector.ca/why-cloud-data-keeps-getting-exposed/]]|Data_Leaks|
|2019.07.05|//Zscaler//|[[The Five Pillars Of Secure Cloud Transformation|https://www.forbes.com/sites/forbestechcouncil/2019/07/05/the-five-pillars-of-secure-cloud-transformation/]]|Best_Practices|
|>|>|>|!2019.07.04|
|2019.07.04|CPO|![[Cloud Solution Provider PCM Discloses Client Information Breach Just Days After Insight Acquisition Announcement; What Happens Next?|https://www.cpomagazine.com/cyber-security/cloud-solution-provider-pcm-discloses-client-information-breach-just-days-after-insight-acquisition-announcement-what-happens-next/]]|Attacks O365 Breach|
|2019.07.04|//CloudChekr//|[[Critical Azure Cloud Security Failures for New Users|https://cloudcheckr.com/cloud-security/critical-azure-cloud-security-failures-for-new-users/]]|Azure Mistakes|
|2019.07.04|//Alibaba//|[[Technical Best Practices for Container Log Processing|https://medium.com/@Alibaba_Cloud/technical-best-practices-for-container-log-processing-d33e64e3e8da]]|Container Logging Best_Practices|
|2019.07.04|//Netwrix//|[[30% of Healthcare Organizations Lack Resources for Data Protection in the Cloud|https://blog.netwrix.com/2019/07/04/infographics-30-of-healthcare-organizations-lack-resources-for-data-protection-in-the-cloud/]]|Report Netwrix|
|>|>|>|!2019.07.03|
|2019.07.03|Ars Technica|![[The Internet broke today: Facebook, Verizon, and more see major outages|https://arstechnica.com/information-technology/2019/07/facebook-cloudflare-microsoft-and-twitter-suffer-outages/]]|Outage|
|2019.07.03|HelpNet Security|[[Disaster recovery readiness is essential for hybrid and multi-cloud strategies|https://www.helpnetsecurity.com/2019/07/03/disaster-recovery-readiness/]]|DRP|
|2019.07.03|HelpNet Security|[[To benefit from DevOps implementation, security and dev teams must communicate better|https://www.helpnetsecurity.com/2019/07/03/devops-implementation/]]|DevOps|
|2019.07.03|Computer Weekly|[[Public cloud: A key component in a disaster recovery plan|https://www.computerweekly.com/feature/Public-cloud-A-key-component-in-a-disaster-recovery-plan]]|DRP|
|2019.07.03|DZone|[[Docker Images and Containers|https://dzone.com/articles/docker-images-and-containers]]|Docker Containers|
|2019.07.03|//Darktrace//|[[Cloud Threat Report 2019|https://customers.darktrace.com/en/cloud-threat-report-2019/]]|Report Darktrace|
|2019.07.05|Silicon.fr[>img[iCSF/flag_fr.png]]| → [[Sécurité cloud : 9 cas d'attaques identifiés par Darktrace|https://www.silicon.fr/securite-cloud-9-cas-darktrace-255037.html]]|Report Darktrace|
|2019.07.03|//Alcide//|[[Kubernetes Vulnerability Scanning|https://blog.alcide.io/kubernetes-vulnerability-scanning]]|Prevention Controls|
|2019.07.03|//PivotPoint Security//|[[Yes, You Still Need Penetration Testing in the Cloud|https://www.pivotpointsecurity.com/blog/yes-you-still-need-penetration-testing-in-the-cloud/]]|PenTest|
|2019.07.03|//Zscaler//|[[Cloud security and the public sector: A dangerous partnership or a growing necessity?|https://www.zscaler.com/blogs/corporate/cloud-security-and-public-sector-dangerous-partnership-or-growing-necessity]]|Misc|
|2019.07.03|//Spanning//|[[Top 3 Enterprise SaaS Data Protection Trends|https://spanning.com/blog/top-3-enterprise-saas-data-protection-trends/]]|DataProtection SaaS|
|2019.07.03|//Managed Methods//|[[Top 5 Security Issues In Cloud Computing|https://managedmethods.com/blog/security-issues-in-cloud-computing/]]|Risks|
|2019.07.03|//IbexLabs//|[[Managed Service Providers Vs. AWS Next-Generation Managed Service Providers|https://www.ibexlabs.com/msps-vs-aws-next-generation-managed-service-providers/]]|MSPs AWS|
|2019.07.03|//Spanning//|[[Top 3 Enterprise SaaS Data Protection Trends|https://spanning.com/blog/top-3-enterprise-saas-data-protection-trends/]]|SaaS Data_Protection|
|>|>|>|!2019.07.02|
|2019.07.02|SANS|[[Building Cloud-Based Automated Response Systems|https://www.sans.org/reading-room/whitepapers/cloud/paper/39050]] ([[document|https://www.sans.org/reading-room/whitepapers/cloud/building-cloud-based-automated-response-systems-39050]])|Response|
|2019.07.02|safeControls|[[CCSK Domain 5: Information governance|https://safecontrols.blog/2019/07/02/ccsk-domain-5-information-governance/]]|CCSK|
|2019.07.02|//Cloudflare//|[[Cloudflare outage caused by bad software deploy (updated)|https://blog.cloudflare.com/cloudflare-outage/]] ([[suivi|https://www.cloudflarestatus.com/incidents/tx4pgxs6zxdr]])|Outage Cloudflare|
|2019.07.02|Bleeping Computer| → [[Cloudflare Worldwide Outage Caused by Bad Software Deployment|https://www.bleepingcomputer.com/news/technology/cloudflare-worldwide-outage-caused-by-bad-software-deployment/]]|Outage Cloudflare|
|2019.07.02|DZone|[[Moving Towards a Standard Operating Model for Kubernetes|https://dzone.com/articles/moving-towards-a-standard-operating-model-for-kube]]|Kubernetes|
|2019.07.02|Solutions Review|[[The Definitive Google Cloud Certifications for Businesses and IT Workers|https://solutionsreview.com/cloud-platforms/the-definitive-google-cloud-certifications-for-businesses-and-it-workers/]]|Certification GCP|
|2019.07.02|Container Journal|[[Successful Container Use: Points to Consider|https://containerjournal.com/2019/07/02/successful-container-use-points-to-consider/]]|Containers|
|2019.07.02|DZone|[[Examining Kubernetes Persistent Volumes|https://dzone.com/articles/examining-kubernetes-persistent-volumes]]|Kubernetes|
|2019.07.02|eSecurity Planet|![[Cloud Security Requires Visibility, Access Control: Security Research|https://www.esecurityplanet.com/cloud/cloud-security-requires-visibility-security-research.html]]|Risks Reports|
|2019.07.02|Gartner|[[Gartner on Securing Cloud-Native Apps|https://www.stackrox.com/post/2019/07/gartner-on-securing-cloud-native-apps/]] (2/3)|Misc|
|2019.07.02|//Canalys//|[[Cybersecurity for public cloud and "as a service" up 45% in Q1 2019|https://www.canalys.com/newsroom/cybersecurity-market-q1-2019]]|Report|
|2019.07.02|//IT Wire//|[[Cyber security for public cloud and 'as-a-service' grew strongly in 1Q2019|https://www.itwire.com/security/cyber-security-for-public-cloud-and-as-a-service-grew-strongly-in-1q2019.html]]|Report|
|2019.07.02|//PaloAlto Networks//|[[See the Unseen in AWS Mirrored Traffic With the VM-Series|https://blog.paloaltonetworks.com/cloud-see-unseen-aws-mirrored-traffic-vm-series/]]|AWS Detection|
|2019.07.02|//CloudRanger//|[[Legal Hold for AWS environments|https://cloudranger.com/legal-hold-for-aws-environments/]]|Legal|
|2019.07.02|//Carbon Black//|[[Addressing the Cyber Security Skills Gap, Part 1|https://www.carbonblack.com/2019/07/02/addressing-the-cyber-security-skills-gap-part-1/]]|Skills|
|2019.07.02|//Caylent//|[[Getting to Grips with Kubernetes Storage|https://caylent.com/getting-to-grips-with-kubernetes-storage/]]|Kubernetes Storage|
|2019.07.02|//Alibaba//|[[Black Hole Policies of Alibaba Cloud Security|https://medium.com/@Alibaba_Cloud/black-hole-policies-of-alibaba-cloud-security-3f2c7fdca19e]]|DDoS Protection|
|2019.07.02|//Aqua//|[[Crypto-mining Attack: The Container Security Demo that Went Terribly Right|https://blog.aquasec.com/crypto-mining-attack-the-container-security-demo-that-went-terribly-right]]|Containers CryptoMining|
|>|>|>|!2019.07.01|
|2019.07.01|Le Mag IT[>img[iCSF/flag_fr.png]]|[[Outscale en passe de devenir le cloud souverain que la France attendait|https://www.lemagit.fr/actualites/252466046/Outscale-en-passe-de-devenir-le-Cloud-souverain-que-la-France-attend]]|Sovereign_Cloud Outscale|
|2019.07.01|Bleeping Computer|[[Tweetdeck Is Down, Currently Experiencing Worldwide Outage|https://www.bleepingcomputer.com/news/security/tweetdeck-is-down-currently-experiencing-worldwide-outage/]]|Outage|
|2019.07.01|Scott Piper|![[re:Inforce Recap|https://summitroute.com/blog/2019/07/01/reinforce_recap/]]|AWS Conference|
|2019.07.01|HelpNet Security|[[What is and what is not working for security operations teams in securing cloud data|https://www.helpnetsecurity.com/2019/07/01/cloud-data-security-concerns/]]|Report|
|2019.07.01|DZone|[[AWS Control Tower & VPC Traffic Mirroring|https://dzone.com/articles/aws-control-tower-amp-vpc-traffic-mirroring]]|AWS|
|2019.07.01|Container Journal|[[Building Secure Production-Ready Kubernetes Clusters and Containers (1/2)|https://containerjournal.com/2019/07/01/building-secure-production-ready-kubernetes-clusters-and-containers-part-1/]]|Containers|
|2019.07.01|DZone|[[Kubernetes Operators: What Are They?|https://dzone.com/articles/kubernetes-operators-what-are-they]]|Kubernetes|
|2019.07.01|DZone|[[Protect Containers To Secure Your Business|https://dzone.com/articles/protect-containers-to-secure-your-business]]|Containers|
|2019.07.01|ComputerWorld|[[4 essential security features built into Microsoft 365|https://www.computerworld.com/article/3405572/4-essential-security-features-built-into-microsoft-365.html]]|O365|
|2019.07.01|Dark Reading|![[There's a Security Incident in the Cloud: Who's Responsible?|https://www.darkreading.com/edge/edge-articles/theres-a-security-incident-in-the-cloud-whos-responsible/d/d-id/1334918]]|IncidentHandling|
|2019.07.01|FCW|[[JEDI and C2E: Is it worth comparing the DOD and ODNI cloud plans?|https://fcw.com/articles/2019/07/01/dod-jedi-odni-c2e-cloud-compare.aspx]]|Government JEDI|
|2019.07.01|Dark Reading|[[Attunity Data Leak Exposes Sensitive Files at Ford, TD Bank|https://www.darkreading.com/document.asp?doc_id=1335105]]|DataLeak S3|
|2019.07.01|TEISS|[[Unsecured AWS S3 buckets leaked data belonging to Fortune 100 firms|https://www.teiss.co.uk/news/s3-buckets-data-exposed/]]|Data_Leaks|
|2019.07.01|//ExtraHop//|![[How to Apply CIS Controls & MITRE ATT&CK in the Cloud|https://www.extrahop.com/company/blog/2019/how-to-apply-security-controls-in-hybrid-cloud/]]|CIS_Controls|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Juillet 2019]]>>
!"//Highlights from the CSA Summit at Cyberweek//"
[>img(150px,auto)[iCSA/J73BH.jpg]]Article de blog publié le 3 juillet 2019 — Rédigé par Moshe Ferber, Président du Chapitre israélien de la CSA, et Damir Savanovic, Senior Innovation Analyst, CSA.
<<<
Tel-Aviv est une ville surpeuplée tout au long de l'année avec un écosystème de cybersécurité en effervescence, mais dans la dernière semaine de juin, cet écosystème se met à bouillir lorsque l'Université de Tel-Aviv accueille ''Cyberweek'', sa conférence annuelle. Avec 9 000 visiteurs de plus de 80 pays différents, elle constitue une des plus importantes conférences du monde dans le domaine de la cybersécurité.
C'est dans ce merveilleux environnement d'innovation en cybersécurité, que la Cloud Security Alliance a tenu son premier sommet de Tel Aviv dans le cadre de la ''Cyberweek''. Au cours de la semaine, la ''CSA'' a organisé une formation CCSK et une journée complète de conférences sur l'état actuel et l'avenir du Cloud.

L'un des points forts de la ''Cyberweek'' est que ses organisateurs ont réussi à rendre la conférence attrayante pour tous les publics : les militaires, les autorités et le secteur privé y trouvent tous un intérêt. Qu'il s'agisse de décideurs ou de geeks, il y en a pour tous les goûts. On retrouvait cette même diversité au Sommet de la ''CSA'' où les décideurs pouvaient assister à des conférences telles que....
* Le discours d'ouverture de Damir Savanovic, de la ''CSA'', qui a prononcé deux excellents allocutions sur la certification du Cloud et l'avenir de Blockchain dans le Cloud
** Vidéo → [[YouTube - JrZD-SLP-Is|https://www.youtube.com/watch?v=JrZD-SLP-Is]]
* Le conseiller du CISO d'ABN AMRO - Olaf Streutker approfondit le modèle octogonal du Cloud, un modèle innovant qui met les entreprises au défi d'étudier les risques sous un autre angle que celui du fournisseur de services cloud. (Le livre blanc sur le modèle octogonal a été publié le même jour par le groupe de travail ''CSA'' sur les Services) Financiers)
** Vidéo → [[YouTube - qJpZDcJyAw4|https://www.youtube.com/watch?v=qJpZDcJyAw4]]
* Yuval Segev, de l'Agence nationale israélienne du cyberespace, a expliqué le modèle INCD (Israel National Cyber Directorate) pour la gestion des risques de la chaîne d'approvisionnement (l'adoption du Cloud fait peser un grand poids sur l'évaluation de cette dernière)
** Vidéo → [[YouTube - DlXBGtOq9i4|https://www.youtube.com/watch?v=DlXBGtOq9i4]]
* Nicola Sfondrini, Ph. D., a partagé sur le succès du Chapitre italien de la ''CSA'' qui a aidé le gouvernement de son pays sur la voie de l'adoption réussie du cloud computing.
**Vidéo → [[YouTube - VdEtgcv8N84|https://www.youtube.com/watch?v=VdEtgcv8N84]]

Pour les congressistes qui s'intéressaient davantage à l'innovation technologique :
* Eitan Satmary de l'équipe de sécurité de WIX a parlé de la gestion de la sécurité Web pour des millions d'environnements utilisateurs tandis que Boris Giterman de Dell EMC a détaillé leur projet pour créer la confiance dans le cloud, en collaboration avec l'UE.
** Vidéo → [[YouTube - M8te4ogMCOs|https://www.youtube.com/watch?v=M8te4ogMCOs]]
* Les participants intéressés par le dynamisme de l'innovation en Israël et le rôle des start-ups dans le pays, ont pu assister à une brillante conférence d'Ofer Smadari (fondateur de Luminate, acquis par Symantec) sur la transformation d'une idée sur le SDP (//software-defined perimeter//) en une acquisition par l'une des plus grandes entreprises du monde
** Vidéo → [[YouTube - 8JwWH0ZKT9w|https://www.youtube.com/watch?v=8JwWH0ZKT9w]]
* Ivan Robles du Chapitre espagnol de la ''CSA'' a partagé un point de vue intéressant sur la façon d'effectuer des audits et des investigations dans le Cloud, tandis que Ian Evans de OneTrust a donné de précieux conseils sur la façon de surmonter nos défis les plus courants dans le domaine de la sécurité et la confidentialité.
** Vidéo → [[YouTube -AK2FPq2teCw|https://www.youtube.com/watch?v=AK2FPq2teCw]]
* Le discours de clôture a été prononcé par Tim Rains d'AWS, jaugeant les mythes et les opportunités de la sécurité dans le Cloud
** Vidéo → [[YouTube - kyFtO2egxbw|https://www.youtube.com/watch?v=kyFtO2egxbw]]

Si vous n'avez pas pu assister à la conférence ou si vous désirez y assister de nouveau, vous pouvez visionner les présentations du ''CSA Summit'' sur [[Youtube|https://www.youtube.com/playlist?list=PLrsvn13Tgp7R4sFr4jmbxxn5BDdT3szLQ]]
2019 a donc été la première fois qu'un sommet de la ''CSA'' s'est tenu dans le cadre de la ''Cyberweek'' de Tel Aviv, mais nous sommes convaincus que la combinaison d'un excellent site, d'une grande variété de sujets et de l'audience attractive de ''Cyberweek'', sont la recette pour rendre cet évènement un incontournable de la ''Cyberweek''.
Vous trouverez sur l'article original quelques photos du ''CSA Summit'' et de la ''Cyberweek''.
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/03/highlights-from-the-csa-summit-at-cyberweek/]] sur le blog de la CSA
Le site Web de la ''Cloud Security Alliance'' a changé d'aspect.
Avec une nouvelle symbolique, il est aussi plus fluide et plus facile à consulter depuis un smartphone.
Le lien est toujours : ''[[CloudSecurityAlliance.org|https://CloudSecurityAlliance.org]]''

L'iconographie ci-dessous reprend les principales catégories
{{floatC{ <<tiddler [[2019.07.03 - RollJ73]]>> }}}
<<QOTD [[2019.07.03 - RolledJ73]] 1500 noclick norandom>>
!Adhésion — Participation
[img(auto,200px)[iCSA/J73Membership.jpg]] [img(auto,200px)[iCSA/J73STARreg.png]]
https://cloudsecurityalliance.org/membership/
----
!Certification — STAR — RGPD
[img(auto,200px)[iCSA/J73STAR.png]] — [img(auto,200px)[iCSA/J73GDPR.jpg]]
https://cloudsecurityalliance.org/star/ — https://cloudsecurityalliance.org/star/
----
!Formation — CCSK — Webinar CloudBytes
[img(auto,200px)[iCSA/J73CCSK.png]] — [img(auto,200px)[iCSA/J73CloudBytes.png]] — [img(auto,200px)[iCSA/J73Galaxy.png]]
https://cloudsecurityalliance.org/education/ — https://cloudsecurityalliance.org/education/ccsk/
----
!Recherche — Groupes de travail — Publications
[img(auto,200px)[iCSA/J73Research.jpg]] — [img(auto,200px)[iCSA/J73Research.png]] — [img(auto,200px)[iCSA/J73Research.png]]
https://cloudsecurityalliance.org/research/ — https://cloudsecurityalliance.org/research/working-groups/
----
!Communauté — Blog — Evénements — Chapitres
[img(auto,200px)[iCSA/J73Community.jpg]] — [img(auto,200px)[iCSA/J73WG.png]]
https://blog.cloudsecurityalliance.org/ — https://csacongress.org/ — https://cloudsecurityalliance.org/chapters/
----
!CSA — Organisation — Historique — Presse
[img(auto,200px)[iCSA/J73About.jpg]] — [img(auto,200px)[iCSA/J73CSAnet.png]]
https://cloudsecurityalliance.org/about/history/ — https://cloudsecurityalliance.org/about/management-staff/ — https://cloudsecurityalliance.org/articles/
----
!Migration dans le Cloud — Définition d'une stratégie Cloud — Initiatives Métiers
[img(auto,200px)[iCSA/J73Transitioning.png]] — [img(auto,200px)[iCSA/J73CloudStrategy.png]] — [img(auto,200px)[iCSA/J73Business.png]]
----
!Problématique IoT — Problématique Menaces — Problématique Informatique Quantique
[img(auto,200px)[iCSA/J73IoT.png]] — [img(auto,200px)[iCSA/J73TopThreats.png]] — [img(auto,200px)[iCSA/J73Quantum.png]]
----
!Base de connaissances — Registre STAR — Recherche
[img(auto,200px)[iCSA/J73KC.png]] — [img(auto,200px)[iCSA/J73STARRegistry.png]] — [img(auto,200px)[iCSA/J73Research2.png]]
----
!Logos
[img(auto,200px)[iCSA/J73CSARGB.png]]
!"The State of SDP Survey: A Summary"
[<img(200px,auto)[iCSA_/J72SDPinfogr.png]][>img(200px,auto)[iCSA_/J72TSOSDPSAS.png]]Article de blog publié le 2 juillet 2019
<<<
Le premier sondage annuel ''CSA'' "''State of Software-Defined Perimeter''" est disponible sous la forme d'une infographie.
Il évalue le niveau de prise de conscience et d'adoption de cette architecture de sécurité.
[...]
Les résultats sont contrastés: seuls 24% déclarent bien connaître les concepts du SDP, et 29% "à peu près", contre 35% en ayant entendu parler, et 11% pas du tout.
Une majorité des entités confirment le besoin de changer leur approche vers une architecture "Zero Trust", 70% des interviewés exprimant un besoin clair de changer leur approche du contrôle d'accès des utilisateurs, en améliorant l'authentification et la gestion des habilitations des utilisateurs.
[...]
Au niveau de l'adoption du SDP, une majorité l'utilisent soit en tant que remplacement du VPN(64%), soit en tant qu'alternative au NAC (55%), tous deux étant typique d'un premier projet de SDP.
<<<
&rArr; Lire [[l'article original|https://blog.cloudsecurityalliance.org/2019/07/02/the-state-of-sdp-survey-a-summary/]] sur le blog de la CSA
&rArr; Accéder à l'inforgraphie aux formats [[image|https://blog.cloudsecurityalliance.org/wp-content/uploads/sites/3/2019/07/SDP-Survey2.jpg]] ou [[pdf|https://cloudsecurityalliance.org/artifacts/sdp-awareness-and-adoption-infographic]].
!"Using The CAIQ-Lite to Assess Third Party Vendors"
[>img(200px,auto)[iCSA_/CAIQ-LITE-whitepaper.png]]Article de blog publié le 1^^er^^ juillet 2019 — par Dave Christiansen, Marketing Director, Whistic
<<<
La simple référence à des "questionnaires de sécurité" peut faire penser à des centaines de questions visant à auditer les processus internes afin de réduire le risque pour les tiers. Cela se traduit généralement par un long processus de préparation à optimiser. Bien que nous ne soyons pas contre la rigueur dans l'évaluation de tiers, afin de suivre le rythme de croissance des entreprises de Cloud Computing, des normes plus légères peuvent servir comme des "passerelles" qui accélèrent l'évaluation du risque pour le fournisseur.
Comme vous l'avez probablement déjà entendu, Whistic et la Cloud Security Alliance ont collaboré pour créer la version initiale du ''CAIQ-Lite'' afin d'encourager la rationalisation de l'évaluation et des processus de sécurité des fournisseurs. La particularité du ''CAIQ-Lite'' réside dans sa construction générale, qui conserve les 16 domaines de contrôle contenus dans la ''Cloud Controls Matrix'' 3.0.1 tout en réduisant le total des questions de 295 à 73. Cela donne plus de poids à chaque question au sein de ''CAIQ-Lite'', retenue pour son importance et sa priorité par rapport aux autres qui ont été omises.
Comme ''CAIQ-Lite'' a été publié il y a tout juste trois mois, nous avons reçu un certain nombre de questions sur ce que sont les cas d'usage idéaux. Ci-dessous se trouve une liste initiale des ressources compilées à ce jour :
* Une excellente mesure de référence qui peut être prise en compte dans la modélisation des risques et vos rapports.
* L'étape initiale d'un processus potentiellement à plusieurs étapes, visant à recevoir une réponse initiale et à aiguiller des fournisseurs spécifiques vers une évaluation ''CAIQ'' complète.
* Une bonne façon d'auditer rapidement tout fournisseur de statut "signalé" ou suspect.
* Pour toute tierce partie qui pourrait avoir besoin d'une cadence plus élevée en matière de gestion des risques.
* Conditions dans lesquelles les fournisseurs tiers n'ont qu'un accès restreint aux données de votre entreprise.
* Un outil de réengagement pour tous les fournisseurs qui ne se sont pas précédemment conformés de manière satisfaisante, ou qui ont peut-être été sous-performants dans leur communication sur cet aspect.
* Un questionnaire d'introduction à la sécurité idéal pour les fournisseurs dont l'équipe de sécurité de l'information est en pleine expansion et qui n'est peut-être pas suffisamment exposée à des normes plus étendues.
Nous continuons de compiler les commentaires sur cette nouvelle norme et nous encourageons les membres de la ''CSA'' de s'auto-évaluer par rapport à ''CAIQ-Lite'' puis de formuler des questions et/ou suggestions afin que début 2020, la version finale du ''CAIQ-Lite'' soit prête à recevoir des réponses à toutes les questions.
<<<
&rArr; Lire [[l'article original|https://blog.cloudsecurityalliance.org/2019/07/01/using-the-caiq-lite-to-assess-third-party-vendors/]] sur le blog de la CSA
&rArr; Lire +++*[la présentation de CAIQ-Lite]> <<tiddler [[2019.03.01 - Blog : Présentation de 'CAIQ Lite']]>>
!"//It's Time for Security Leadership to Embrace the Cloud-First Future//"
[>img(100px,auto)[iCSA/J7TBI.jpg]]^^Bien que publié le 29 juillet 2019 sur le blog de la CSA, cet article l'a déjà été il y a 1 mois, le 25 juin 2019 sur le site de Forbes.
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/29/its-time-for-security-leadership-to-embrace-the-cloud-first-future/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.forbes.com/sites/extrahop/2019/06/25/its-time-for-security-leadership-to-embrace-the-cloud-first-future/]]^^

!"//4 Reasons Why IT Supervision is a Must in Content Collaboration//"
[>img(100px,auto)[iCSA/J7NB4.jpg]]^^Bien que publié le 23 juillet 2019 sur le blog de la CSA (et qu'aucun auteur ne soit mentionné), cet article l'a déjà été il y a plus de 2 mois, le 16 mai 2019 sur le site de la société Tresorit.
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/23/4-reasons-why-it-supervision-is-a-must-in-content-collaboration/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://tresorit.com/blog/it-supervision-in-content-collaboration/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//How Traffic Mirroring in the Cloud Works//"
[>img(100px,auto)[iCSA/J78BH.jpg]]^^Bien que publié le 8 juillet 2019 sur le blog de la CSA, cet article l'a déjà été il y a 2 semaines, le 25 juin 2019 sur le site de la société ExtraHop.
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/08/how-traffic-mirroring-in-the-cloud-works/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.extrahop.com/company/blog/2019/how-traffic-mirroring-in-the-cloud-works/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201906>>
<<tiddler fAll2Tabs10 with: VeilleM","_201906>>
<<tiddler fAll2LiTabs with: NewsL","201906>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Juin 2019]]>>
|!Juin|!Sources|!Titres et Liens|!Keywords|
|2019.06.26|MITRE CVE|//Kubernetes Command Line Interface kubectl// [[CVE-2019-11246|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11246]]|CVE-2019-11246 Kubernetes|
|2019.06.14|//Microsoft//|[[Prevent the impact of a Linux worm by updating Exim (CVE-2019-10149)|https://blogs.technet.microsoft.com/msrc/2019/06/14/prevent-the-impact-of-a-linux-worm-by-updating-exim-cve-2019-10149/]]|CVE-2019-10149 Exim|
|2019.05.28|MITRE CVE|//Azure DevOps Server Spoofing Vulnerability// [[CVE-2019-0996|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0996]]|CVE-2018-0996 Azure|
|2019.06.11|//Microsoft//| → [[CVE-2019-0996: Azure DevOps Server Spoofing Vulnerability|https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0996]]|CVE-2019-0996 Azure|
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Juin 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Juin 2019]]>><<tiddler fAll2LiTabs with: Actu","201906>>
<<tiddler fAll2LiTabs with: Blog","201906>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Juin 2019]]>>
<<tiddler fAll2LiTabs with: Publ","201906>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Juin 2019]]>>
!1 - Les nouveautés CSA de la semaine du 24 au 30 juin 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : "''How to Improve the Accuracy and Completeness of Cloud Computing Risk Assessments?''"+++*[»]> <<tiddler [[2019.06.24 - Blog : Améliorer l'exactitude et l'exhaustivité de l'évaluation des risques dans le Cloud]]>>=== 
* Publication : "''Cloud Octagon Model''"+++*[»]> <<tiddler [[2019.06.24 - Publication : Cloud Octagon Model]]>>=== 
!2 - Veille Web
La [[Veille Web|2019.06.30 - Veille Hebdomadaire]] avec plus d'une centaine liens dont :
* Alerte : CVE-2019-11246 sur Kubernetes
* Pannes : Cloudflare (des explications), Slack
* Piratage et fuite de données : PCM (fournisseur d'énergie Cloud), Attunity, Cloud Hopper
* AWS re:Inforce 2019 : retours sur la conférence, disponibilité de AWS ''Security Hub'' et ''AWS Control Tower''
* Rapport et sondages : Recorded Future, CyberArk, Symantec
* Divers : Kubernetes, OneDrive, menaces et risques...
!3 - Agenda
* ''28 __juillet__'' : clôture de l'appel à présentations pour le ''CSA Congress EMEA'' des 20 et 21 novembre 2019 à Berlin+++*[»]> <<tiddler [[2019.06.21 - Actu : Encore un mois pour soumettre un sujet au CSA Congress EMEA 2019]]>>=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Juin|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.06.30|
|2019.06.30|RSA Confrence|[[Ben's Book of the Month: Review of "Practical Cloud Security: A Guide for Secure Design and Deployment"|https://www.rsaconference.com/blogs/bens-book-of-the-month-review-of-practical-cloud-security-a-guide-for-secure-design-and-deployment]]|Book Architecture Design|
|>|>|>|!2019.06.29|
|2019.06.29|safeControls|[[CCSK Domain 4 - Compliance and Audit Management|https://safecontrols.blog/2019/06/29/ccsk-domain-4-compliance-and-audit-management/]]|CCSK|
|>|>|>|!2019.06.28|
|2019.06.28|Global Security Mag[>img[iCSF/flag_fr.png]]|[[Rapport Gauvin - Rebond 3DS OUTSCALE : La nécessité d' être Souverain|http://www.globalsecuritymag.fr/Rapport-Gauvin-Rebond-3DS-OUTSCALE,20190628,88595.html]]|Legal Outscale|
|2019.06.28|Réseaux & Télécoms[>img[iCSF/flag_fr.png]]|[[Oracle annonce la fermeture de Dyn et le déplacement des services DNS dans son cloud|http://www.reseaux-telecoms.net/actualites/lire-oracle-annonce-la-fermeture-de-dyn-et-le-deplacement-des-services-dns-dans-son-cloud-27779.html]]|DNS Oracle EndOfLife|
|2019.06.28|Bleeping Computer|[[Slack Is Experiencing Worldwide Outage, Degraded Performance|https://www.bleepingcomputer.com/news/security/slack-is-experiencing-worldwide-outage-degraded-performance/]]|Outage Slack|
|2019.06.28|ThreatStack|[[AWS re:Inforce 2019 Recap: A Look Back at the First AWS Security Show|https://www.threatstack.com/blog/aws-reinforce-2019-recap-a-look-back-at-the-first-aws-security-show]]|AWS Conference|
|2019.06.28|TechRepublic|[[How to set up multi-factor authentication for an IAM user in AWS|https://www.techrepublic.com/article/how-to-set-up-multi-factor-authentication-for-an-iam-user-in-aws/]]|IAM AWS|
|2019.06.28|DZone|[[Introduction to Kubernetes Security|https://dzone.com/articles/introduction-to-kubernetes-security]]|Kubernetes|
|2019.06.28|CSO|[[AWS re:Inforce 2019: Amazon shows its dedication to cloud security|https://www.csoonline.com/article/3405581/aws-reinforce-2019-amazon-shows-its-dedication-to-cloud-security.html]]|AWS Conference|
|2019.06.28|ToolBox|[[Track the Difference Between Cloud Hosting Vs Shared Web Hosting|https://it.toolbox.com/blogs/ugranarayanpandey/track-the-difference-between-cloud-hosting-vs-shared-web-hosting-062819]]|Hosting|
|2019.06.28|//TrendMicro//| → [[AWS re:Inforce 2019 re:Cap|https://blog.trendmicro.com/aws-reinforce-2019-recap/]]|AWS Conference|
|2019.06.28|//IS Decision//|[[Under a Cloud of Suspicion|https://www.isdecisions.com/cloud-storage-security-issues/]]|Report SMBs|
|2019.07.19|DZone| → [[Cloud Security Concerns Among Small and Medium Businesses|https://dzone.com/articles/61-of-smbs-believe-that-their-data-is-unsafe-in-th]]|Report SMBs|
|2019.06.28|//RecordedFuture//|[[How Much Budget Are Enterprises Really Dedicating to Security?|https://www.recordedfuture.com/enterprise-security-budget/]] ([[rapport|https://go.recordedfuture.com/cyberedge-cyberthreat-defense-report-2019]])|Report Threats|
|2019.06.28|//CloudCheckr//|[[Building a Secure Public Sector Cloud with the Center for Internet Security|https://cloudcheckr.com/cloud-security/the-best-security-tools-for-cybersecurity-in-the-cloud/]]|Compliance|
|2019.06.28|//Armor//|[[Budgeting for Cloud Security|https://www.armor.com/blog/budgeting-for-cloud-security/]]|Budget|
|2019.06.28|//Whistic//|[[Phase 4 of The 5 Phases of Responding to a Security Questionnaire & How To Get Proactive '4/5)|https://blog.whistic.com/phase-4-of-the-5-phases-of-responding-to-a-security-questionnaire-how-to-get-proactive-1e3c138f30bb]]|Misc|
|2019.06.28|//Rapid7//|[[Securing Your Cloud Environment with InsightIDR, Part 1: Microsoft Azure|https://blog.rapid7.com/2019/06/28/securing-your-cloud-environment-with-insightidr-part-1-microsoft-azure/]] (1/3)|Azure|
|>|>|>|!2019.06.27|
|2019.06.27|KrebsOnSecurity|![[Breach at Cloud Solution Provider PCM Inc.|https://krebsonsecurity.com/2019/06/breach-at-cloud-solution-provider-pcm-inc/]]|Attacks O365 Breach|
|2019.06.28|MSSP Alert| → [[PCM Breach: Hackers Gain Microsoft Office 365 Credentials at IT Solutions Provider|https://www.msspalert.com/cybersecurity-news/pcm-office365-breach//]]|Attacks O365 Breach|
|2019.06.27|SiliconAngle|[[Can cloud providers keep sky from falling on cybersecurity?|https://siliconangle.com/2019/06/27/can-cloud-providers-keep-sky-from-falling-on-cybersecurity-reinforce/]] ([[vidéo|https://video.cube365.net/v/jboyAlJc89M]])|Misc|
|2019.06.27|ComputerWeekly|[[Cloud snapshots and backups: How to protect data in the cloud|https://www.computerweekly.com/feature/Cloud-snapshots-and-backups-How-to-protect-data-in-the-cloud]]|Backups|
|2019.06.27|Dark Reading|[[Office 365 Multifactor Authentication Done Right|https://www.darkreading.com/perimeter/office-365-multifactor-authentication-done-right/a/d-id/1335039]]|O365|
|2019.06.27|GBHackers on Security|[[Most Important Checklist for Security Leakage Before Initiating Data Migration in Your Organization|https://gbhackers.com/important-checklist-security-leakage/]]|Controls|
|2019.06.27|CIO|[[Data breach exposed apprentices' passport details, employment agreements|https://www.cio.com.au/article/663251/data-breach-exposed-apprentices-passport-details-employment-agreements/]]|DataLeak AWS Bucket|
|2019.06.27|DZone|[[Secure Cloud Storage in 3 Steps|https://dzone.com/articles/secure-cloud-storage-in-3-steps]]|Storage|
|2019.06.27|//UpGuard//|![[Data Warehouse: How a Vendor for Half the Fortune 100 Exposed a Terabyte of Backups|https://www.upguard.com/breaches/attunity-data-leak]]|DataLeak S3|
|2019.06.27|//Threatpost//| → [[Leaky Amazon S3 Buckets Expose Data of Netflix, TD Bank|https://threatpost.com/leaky-amazon-s3-buckets-expose-data-of-netflix-td-bank/146084/]]|DataLeak S3|
|2019.06.28|MSSP Alert| → [[AWS Cloud Data Leak: Qlik's Attunity Exposes Backup Information|https://www.msspalert.com/cybersecurity-news/aws-cloud-data-leak-attunity/]]|DataLeak S3|
|2019.06.27|//Google//|[[Chronicle Joining Google Cloud|https://medium.com/@chroniclesec/chronicle-joining-google-cloud-c29037ee2d89]]|GCP|
|2019.06.27|//Google//| → [[Google Cloud + Chronicle: The security moonshot joins Google Cloud|https://cloud.google.com/blog/topics/inside-google-cloud/the-security-moonshot-joins-google-cloud]]|GCP|
|2019.06.27|//Fugue//|[[Shift Left on Cloud Security, Part III: Extending into Production|https://www.fugue.co/blog/shift-left-on-cloud-security-part-iii-extending-into-production]] (3/3)|Risks|
|2019.06.27|//Caylent//|[[Updating and Modernizing: Moving from Virtual Machines to Containers|https://caylent.com/moving-from-virtual-machines-to-containers/]]|Containers VMs|
|2019.06.27|//CloucdCheckr//|[[The Best Security Tools for Cybersecurity in the Cloud|https://cloudcheckr.com/cloud-security/the-best-security-tools-for-cybersecurity-in-the-cloud/]]|Tools|
|2019.06.27|//Aporeto//|[[Cloud Migration Security Strategy|https://www.aporeto.com/blog/cloud-migration-security-strategy/]]|Migration|
|>|>|>|!2019.06.26|
|2019.06.26|DZone|[[Deep Dive into Cloud Firewall: Addressing Aggressive Mining Worms|https://dzone.com/articles/deep-dive-into-cloud-firewall-addressing-aggressiv]]|Firewalls|
|2019.06.26|DZone|[[What is PaaS? Platform-as-a-Service Types Explained|https://dzone.com/articles/what-is-paas-platform-as-a-service-types-explained-1]]|PaaS|
|2019.06.26|Reuters|![[Inside the West's failed fight against China's 'Cloud Hopper' hackers|https://www.reuters.com/investigates/special-report/china-cyber-cloudhopper/]]|Attacks APT CloudHopper|
|2019.06.26|Silicon| → [[Chinese Ministry Hackers Hit Eight Services Firms - Report|https://www.silicon.co.uk/security/cyberwar/chinese-ministry-hackers-services-firms-266767]]|Attacks APT CloudHopper|
|2019.06.26|InfoRisk Today| → [[Cloud Hopper: Major Cloud Services Victims Named|https://www.inforisktoday.com/cloud-hopper-major-cloud-services-victims-named-a-12695]]|Attacks APT CloudHopper|
|2019.06.26|Data Security Breach[>img[iCSF/flag_fr.png]]|[[Stockage Cloud et sécurité : trois problèmes rencontrés par les PME|https://www.datasecuritybreach.fr/stockage-cloud-et-securite-trois-problemes-rencontres-par-les-pme/]]|Risks|
|2019.06.26|Solutions Review|[[4 Cloud Computing Risks and How Your Business Can Avoid Them|https://solutionsreview.com/cloud-platforms/4-cloud-computing-risks-and-how-your-business-can-avoid-them/]]|Risks|
|2019.06.26|SecurityWeek|[[AWS Launches Mirroring Feature for Inspecting Network Traffic|https://www.securityweek.com/aws-launches-mirroring-feature-inspecting-network-traffic]]|AWS Monitoring|
|2019.06.26|TechRepublic|[[Docker containers are filled with vulnerabilities: Here's how the top 1,000 fared|https://www.techrepublic.com/article/docker-containers-are-filled-with-vulnerabilities-heres-how-the-top-1000-fared/]]|Docker Vulnerabilities|
|2019.06.26|TechRepublic|[[AWS re:Inforce 2019 - Day 1 Recap|https://www.threatstack.com/blog/aws-reinforce-2019-day-1-recap]]|AWS Conference|
|2019.06.26|MITRE CVE|!Kubernetes Command Line Interface kubectl [[CVE-2019-11246|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11246]]|CVE-2019-11246 Kubernetes|
|2019.06.26|//Google//| → [[Kubernetes CVE-2019-11246|https://cloud.google.com/kubernetes-engine/docs/security-bulletins#june-25-2019]]|CVE-2019-11246 Kubernetes|
|2019.06.26|ZDnet| → [[Kubernetes CLI tool security flaw lets attackers run code on host machine|https://www.zdnet.com/article/kubernetes-cli-tool-security-flaw-lets-attackers-run-code-on-host-machine/]]|CVE-2019-11246 Kubernetes|
|2019.06.26|Cybersecurity Insiders|[[How Doxing can prove as a threat to Cloud Security|https://www.cybersecurity-insiders.com/how-doxing-can-prove-as-a-threat-to-cloud-security/]]|Risks|
|2019.06.26|//CTERA//[>img[iCSF/flag_fr.png]]|[[Quels impératifs faut-il respecter en matière de sécurité du Cloud ?|https://www.journaldunet.com/solutions/expert/71337/quels-imperatifs-faut-il-respecter-en-matiere-de-securite-du-cloud.shtml]]|Risks|
|2019.06.26|//Avanan//|[[Top Takeaways from the 2019 Gartner Security & Risk Management Summit|https://www.avanan.com/resources/takeaways-from-2019-gartner-security-summit]]|Gartner Conference|
|2019.06.26|//CloudFlare//|![[The deep-dive into how Verizon and a BGP Optimizer Knocked Large Parts of the Internet Offline Monday|https://blog.cloudflare.com/the-deep-dive-into-how-verizon-and-a-bgp-optimizer-knocked-large-parts-of-the-internet-offline-monday/]]|Outage AWS Cloudflare|
|2019.06.26|//Armor//|[[Securing Apps and Data in the Public Cloud - It Takes a Village|https://www.armor.com/blog/securing-apps-and-data-in-the-public-cloud/]] ([[vidéo|https://www.youtube.com/watch?v=senX8XSnN-c]])|Misc|
|2019.06.26|//CyberArk//|![[CyberArk Global Advanced Threat Landscape Report 2019: Focus on Cloud|https://www.cyberark.com/resource/global-advanced-threat-landscape-2019-focus-on-cloud/]]|Report|
|2019.06.25|DataCenter Mag[>img[iCSF/flag_fr.png]]| → [[Vulnérable par excès de confiance en ses fournisseurs de Cloud|http://datacenter-magazine.fr/vulnerables-par-exces-de-confiance-en-ses-fournisseurs-de-cloud/]]|Report CyberArk|
|2019.06.26|isBuzzNews| → [[CyberArk Report Shows 70 Percent of UK Organisations Rely Primarily on Cloud Providers to Protect Their Workloads|https://www.informationsecuritybuzz.com/study-research/survey-organisations-increase-risk-with-over-reliance-on-cloud-vendors-for-security/]]|Report CyberArk|
|2019.06.26|TEISS| → [[Majority of enterprises relying on cloud providers to secure their data|https://www.teiss.co.uk/threats/cloud-providers-data-security/]]|Report CyberArk|
|2019.06.27|TechRepublic| → [[How organizations face risks by relying too much on cloud vendors for security|https://www.techrepublic.com/article/how-organizations-face-risks-by-relying-too-much-on-cloud-vendors-for-security/]]|Report CyberArk|
|2019.06.28|HelpNet Security| → [[Over reliance on public cloud vendor security puts data and companies at risk of breach|https://www.helpnetsecurity.com/2019/06/28/public-cloud-vendor-security/]]|Report CyberArk|
|2019.07.08|IT Pro[>img[iCSF/flag_fr.png]]| → [[Les entreprises pêchent par excès de confiance en leurs fournisseurs de Cloud|https://www.itpro.fr/les-entreprises-pechent-par-exces-de-confiance-en-leurs-fournisseurs-de-cloud/]]|Report CyberArk|
|2019.06.26|//Alibaba//|[[Use a Local Disk Through LocalVolume Provisioner in a Kubernetes Cluster|https://medium.com/@Alibaba_Cloud/use-a-local-disk-through-localvolume-provisioner-in-a-kubernetes-cluster-671ebfd16a69]]|Alibaba Kubernetes|
|2019.06.26|//BitDefender//|[[5 Cloud Security Concerns That Still Keep Cybersecurity Pros Up at Night|https://businessinsights.bitdefender.com/5-cloud-security-concerns-that-still-keep-cybersecurity-pros-up-at-night]]|Threats|
|2019.06.26|//Lacework//|[[Why Linux Servers Need Extra Security|https://www.lacework.com/linux-servers-need-extra-security/]]|Linux Containers|
|>|>|>|!2019.06.25|
|2019.06.25|Global Security Mag[>img[iCSF/flag_fr.png]]|[[63% Le chiffre CenturyLink sécurité / cloud du 2ème trimestre 2019|http://www.globalsecuritymag.fr/63-Le-chiffre-CenturyLink-securite,20190626,88548.html]]|Report|
|2019.06.25|CISO Mag|[[IoT Security: Needed now more than ever|https://www.cisomag.com/iot-security-needed-now-more-than-ever/]]|IoT|
|2019.06.25|InfoRisk Today|[[The Evolution of IAM in the Cloud|https://www.inforisktoday.com/interviews/evolution-iam-in-cloud-i-4362]] ([[podcast|https://0267f973c7f511eda6a4-193e28812cee85d6e20ea22afb83e185.ssl.cf1.rackcdn.com/evolution-iam-in-cloud-directLink-6-i-4362.mp3]])|CSA IAM|
|2019.06.25|DZone|[[Cloud-Native Best Business Practices (Part 2): Why Cattle, Not Pets|https://dzone.com/articles/cloud-native-best-business-practices-part-2-why-ca]] (2/7)|Misc|
|2019.06.25|BetaNews|[[Cloud identity solution lets developers deliver passwordless login and MFA|https://betanews.com/2019/06/25/cloud-identity-developers-passwordless-mfa/]]|Authentiction|
|2019.06.25|Team ARIN|[[Why is IPv6 faster?|https://teamarin.net/2019/06/25/why-is-ipv6-faster/]]|IPv6|
|2019.06.25|//Security Intelligence (IBM)//|[[Why Doxing Is the Dr. Jekyll and Mr. Hyde of Cloud Security|https://securityintelligence.com/posts/why-doxing-is-the-dr-jekyll-and-mr-hyde-of-cloud-security/]]|Misc|
|2019.06.25|//Alibaba//|[[Scanning and Intrusion Script Analysis for DockerKiller Threat|https://medium.com/@Alibaba_Cloud/scanning-and-intrusion-script-analysis-for-dockerkiller-threat-9a1f4d6a68d9]]|Docker Attacks |
|2019.06.25|//Alibaba//|[[How to Protect Your Websites from HTTP(S) Flood|https://medium.com/@Alibaba_Cloud/how-to-protect-your-websites-from-http-s-flood-906429f7a30f]]|DDoS Protection|
|2019.06.25|//Sensu//|[[Monitoring Kubernetes, part 4: the Sensu-native approach|https://blog.sensu.io/monitoring-kubernetes-part-4-the-sensu-native-approach]]|Kubernetes Docker Monitoring|
|2019.06.25|//Microsoft//|[[OneDrive Personal Vault brings added security to your most important files and OneDrive gets additional storage options|https://www.microsoft.com/en-us/microsoft-365/blog/2019/06/25/onedrive-personal-vault-added-security-onedrive-additional-storage/]]|OneDrive PersonalVault|
|2019.06.25|Redmond Channel Partner| → [[Microsoft Expands OneDrive Storage, Debuts 'Personal Vault'|https://rcpmag.com/articles/2019/06/26/microsoft-spruces-up-onedrive.aspx]]|OneDrive PersonalVault|
|2019.06.25|BetaNews| → [[Microsoft OneDrive Personal Vault makes it easy to secure files in the cloud|https://betanews.com/2019/06/25/microsoft-onedrive-personal-vault/]]|OneDrive PersonalVault|
|2019.06.25|!//Kenna Security//|[[One-fifth of the most-used Docker containers have at least one critical vulnerability|https://www.kennasecurity.com/one-fifth-of-the-most-used-docker-containers-have-at-least-one-critical-vulnerability/]]|Containers Docker|
|2019.07.08|Container Journal| → [[Research Finds Loads of Container Vulnerabilities|https://containerjournal.com/2019/07/08/research-finds-loads-of-container-vulnerabilities/]]|Containers Docker|
|2019.06.25|//Symantec//|[[Three Ways to Get a Handle on Cloud Security|https://www.symantec.com/blogs/feature-stories/three-ways-get-handle-cloud-security]]|Misc|
|2019.06.25|//Whistic//|[[Phase 3 of The 5 Phases of Responding to a Security Questionnaire & How To Get Proactive (3/5)|https://blog.whistic.com/phase-3-of-the-5-phases-of-responding-to-a-security-questionnaire-how-to-get-proactive-90b047830a0b]]|Misc|
|2019.06.25|//Lacework//|[[Container Orchestration Demands a Security Focus|https://www.lacework.com/container-orchestration-security-focus/]]|Containers|
|2019.06.25|//Fugue//|[[The 5 Biggest Myths in Cloud Security (And How to Avoid Getting Burned)|https://www.fugue.co/blog/the-5-biggest-myths-in-cloud-security-and-how-to-avoid-getting-burned]]|Misc|
|2019.06.25|//Google//|[[Use security codes to log in where security keys won't work directly|https://gsuiteupdates.googleblog.com/2019/06/security-codes-and-security-keys.html]]|GCP Authentication|
|2019.06.25|//Google//|[[Greater protection and control with three Gmail security tools|https://gsuiteupdates.googleblog.com/2019/06/gmail-security-tools-sandbox-phishing-malware-confidential.html]]|GCP|
|2019.06.26|SecurityWeek| → [[Google Allows G Suite Users to Log In With Security Codes|https://www.securityweek.com/google-allows-g-suite-users-log-security-codes]]|GCP Authentication|
|2019.06.25|//Forcepoint//|[[Accelerating digital transformation with Secure SD-WAN|https://www.forcepoint.com/blog/insights/accelerating-digital-transformation-secure-sd-wan]]|SDWAN|
|2019.06.25|//Tresorit//|[[Cloud Storage Security: How to Secure Your Data in the Cloud?|https://tresorit.com/blog/cloud-storage-security/]]|Storage Authentication|
|2019.06.25|//Tresorit//|[[WeTransfer Security Fail: Files sent to wrong recipients for two days|https://tresorit.com/blog/wetransfer-security-fail/]]|Failure|
|2019.06.25|//Managed Methods//|[[3 Steps To Secure Cloud Storage|https://managedmethods.com/blog/3-steps-to-secure-cloud-storage/]]|Storage|
|2019.06.25|//Microsoft//|![[Top 20 use cases for CASBs|https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3nibJ]] (pdf)|CASB|
|2019.06.25|MSSP Alert|[[Multi-Cloud Security: What's the MSSP Opportunity?|https://www.msspalert.com/cybersecurity-guests/multi-cloud-security-whats-the-mssp-opportunity/]]|Multi_Cloud|
|>|>|>|!2019.06.24|
|2019.06.24|Public Technology|[[NCSC warns over 'password spray' attacks of council cloud services|https://www.publictechnology.net/articles/news/ncsc-warns-over-%E2%80%98password-spray%E2%80%99-attacks-council-cloud-services]]|Attacks|
|2019.06.24|TechWire Asia|[[Why IT asset management is still relevant in the cloud era|https://techwireasia.com/2019/06/why-it-asset-management-is-still-relevant-in-the-cloud-era/]]|Inventory|
|2019.06.24|Cloudflare|![[Route Leak Impacting Cloudflare|https://www.cloudflarestatus.com/incidents/46z55mdhg0t5]]|Outage AWS Cloudflare|
|2019.06.24|Bleeping Computer| → [[BGP Route Leak Causes Cloudflare and Amazon AWS Problems|https://www.bleepingcomputer.com/news/technology/bgp-route-leak-causes-cloudflare-and-amazon-aws-problems/]]|Outage AWS Cloudflare|
|2019.06.24|Cloudflare|![[How Verizon and a BGP Optimizer Knocked Large Parts of the Internet Offline Today|https://blog.cloudflare.com/how-verizon-and-a-bgp-optimizer-knocked-large-parts-of-the-internet-offline-today/]]|Outage AWS Cloudflare|
|2019.06.24|Bleeping Computer| → [[Cloudflare and Amazon AWS Outages Affecting Sites Everywhere|https://www.bleepingcomputer.com/news/technology/cloudflare-and-amazon-aws-outages-affecting-sites-everywhere/]]|Outage AWS Cloudflare|
|2019.06.24|Cloud Native Computing Foundation|[[Demystifying Containers - Part I: Kernel Space|https://www.cncf.io/blog/2019/06/24/demystifying-containers-part-i-kernel-space/]]|Containers|
|2019.06.24|DZone|[[Data Security: An Integral Aspect of Cloud Computing|https://dzone.com/articles/data-security-an-integral-aspect-of-cloud-computin]]|Misc|
|2019.06.24|DZone|[[Coming to Grips with Kubernetes Storage|https://dzone.com/articles/getting-to-grips-with-kubernetes-storage]]|Kubernetes|
|2019.06.24|DZone|[[Cloud-Native Best Business Practices (Part 1): Containerization Cuts Costs|https://dzone.com/articles/cloud-native-best-business-practices-part-1-contai]] (1/7)|Best_Practices|
|2019.06.24|searchCloud Computing|[[Debunk 10 common public cloud myths|https://searchcloudcomputing.techtarget.com/tip/Debunk-10-common-public-cloud-myths#new_tab]]|Perception|
|2019.06.24|The Daily Swig|[[Hack and slash: Cloud-based video games model opens up fresh security risks|https://portswigger.net/daily-swig/hack-and-slash-cloud-based-video-games-model-opens-up-fresh-security-risks]]|Games Risks|
|2019.06.24|CSO|[[How to use the new Microsoft 365 Business Conditional Access feature|https://www.csoonline.com/article/3404471/how-to-use-the-new-microsoft-365-business-conditional-access-feature.html]]|O365|
|2019.06.24|Gartner|[[Gartner's Top 10 Security Projects for 2019 - Container Security Makes the List|https://www.stackrox.com/post/2019/06/gartners-top-10-security-projects-for-2019-container-security-makes-the-list/]] (1/3)|Containers|
|2019.06.24|Federal News Network|[[Under cloud smart, application rationalization takes center stage|https://federalnewsnetwork.com/cloud-computing/2019/06/under-cloud-smart-application-rationalization-takes-center-stage/]]|CloudSmart|
|2019.06.24|//AlienVault//|[[An overview on insider attacks and threat awareness|https://www.alienvault.com/blogs/security-essentials/insider-threats]]|InsiderThreats|
|2019.06.24|//AWS//|![[AWS Security Hub Now Generally Available|https://aws.amazon.com/blogs/aws/aws-security-hub-now-generally-available/]] ([[podcast|https://d2908q01vomqb2.cloudfront.net/polly/da4b9237bacccdf19c0760cab7aec4a8359010b0amazon_polly_29216.mp3]])|AWS Monitoring|
|2019.06.25|//AWS//| → [[Portail AWS Security Hub|https://aws.amazon.com/security-hub/AWS Monitoring]]|AWS Monitoring|
|2019.06.25|SecurityWeek| → [[AWS Announces General Availability of Security Hub|https://www.securityweek.com/aws-announces-general-availability-security-hub]]|AWS Monitoring|
|2019.06.25|The Register| → [[AWS Security Hub takes half-hearted bite out of SIEM vendors' lunches|https://www.theregister.co.uk/2019/06/25/aws_security_hub_launch/]]|AWS Monitoring|
|2019.06.25|HelpMent Security| → [[AWS Security Hub aggregates security alerts and conducts continuous compliance checks|https://www.helpnetsecurity.com/2019/06/25/aws-security-hub/]]|AWS Monitoring|
|2019.06.24|//AWS//|![[AWS Control Tower is now generally available|https://aws.amazon.com/about-aws/whats-new/2019/06/aws-control-tower-is-now-generally-available/]]|AWS Monitoring|
|2019.06.26|//AWS//| → [[AWS Control Tower - Set up & Govern a Multi-Account AWS Environment|https://aws.amazon.com/blogs/aws/aws-control-tower-set-up-govern-a-multi-account-aws-environment/]] ([[podcast|https://d2908q01vomqb2.cloudfront.net/polly/da4b9237bacccdf19c0760cab7aec4a8359010b0amazon_polly_29258.mp3]])|AWS Monitoring|
|2019.06.26|//AWS//| → [[AWS Announces General Availability of AWS Control Tower|https://vmblog.com/archive/2019/06/26/aws-announces-general-availability-of-aws-control-tower.aspx]]|AWS Monitoring|
|2019.06.26|//AWS//| → [[AWS Control Tower|https://aws.amazon.com/controltower]]|AWS Monitoring|
|2019.06.24|//Tripwire//|[[A Google Cloud Platform Primer with Security Fundamentals|https://www.tripwire.com/state-of-security/security-data-protection/cloud/google-cloud-platform/]]|GCP|
|2019.06.24|//AlienVault//|[[An overview on insider threat awareness|https://www.alienvault.com/blogs/security-essentials/insider-threats]]|InsiderThreats|
|2019.06.24|//Symantec//|![[Symantec's Cloud Security Threat - Report Shines a Light on the Cloud's Real Risks|https://www.symantec.com/blogs/feature-stories/symantecs-cloud-security-threat-report-shines-light-clouds-real-risks]] ([[pdf|https://resource.elq.symantec.com/LP=7326]])|Report|
|2019.06.24|BetaNews| → [[Over half of enterprises think security is lagging behind cloud adoption|https://betanews.com/2019/06/24/security-lagging-behind-cloud/]]|Report|
|2019.06.26|HelpNet Security| → [[Cloud security exacerbated by immature security practices|https://www.helpnetsecurity.com/2019/06/26/cloud-security-issues/]]|Report|
|2019.06.24|//Microsoft//|[[5 principles driving a customer-obsessed identity strategy at Microsoft|https://www.microsoft.com/security/blog/2019/06/24/5-principles-driving-customer-obsessed-identity-strategy-microsoft/]]|Identify|
|2019.06.24|//TrendMicro//|[[Addressing Security Challenges in Hybrid Cloud Computing Environments|https://pupuweb.com/address-security-challenges-hybrid-cloud/]]|Hybrid_Cloud|
|2019.06.24|//AlertLogic//|[[The Road to AWS re:Inforce 2019 - Unique Perspective from a Customer|https://blog.alertlogic.com/the-road-to-aws-reinforce-2019-unique-perspective-from-a-customer/]]|AWS Conference|
|2019.06.24|//Rapid7//|[[Rapid7 Releases Cloud Configuration Assessment Capabilities in InsightVM|https://blog.rapid7.com/2019/06/24/rapid7-releases-cloud-configuration-assessment-capabilities-in-insightvm/]]|Assessment|
|2019.06.24|Medium|[[An Introduction to Docker for Novices|https://medium.com/techloop/an-introduction-to-docker-for-novices-ec5dec797ce6]]|Docker|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Juin 2019]]>>
!CSA EMEA Summit @ Cyber Week 2019[>img(250px,auto)[iCSA/201906IL-TelAviv.jpg]]
Le ''CSA EMEA Summit'' aura lieu le 24 juin 2019 de 9h à 16h à l'Université de Tel Aviv (//Auditorium Fastlicht//, dans le bâtiment //Mexico//)
C'est la première fois que la [[Cloud Security Alliance]] organise une conférence en Israël.

Les thèmes abordés seront :
* la conception de Cloud pour des activités critiques
* des retours d'expérience sur la sécurité de Cloud d'enterprises
* le RGPD et le Cloud
* les facteurs d'accélération comme l'intelligence artificielle, le blockchain et l'Internet des Objets.

__Programme :__
|Table98|k
|08:30-09:00|Enregistrement|
|09:00-09:15|Introduction (Jim Reavis, Cloud Security Alliance)|
|09:15-10:15|!"Cyber Security Risks in Supply Chain: Nation Level Guidelines and Course of Action" (Yuval Segev, Israel National Cyber Directorate)|
|10:15-10:30|Pause|
|10:30-12:00|!"Lessons Learned from an Award-Winning Cloud Security Program" (Jairo Orea, Kimberly-Clark)|
|~|"Israel Innovation & Cloud Computing" (Ofer Smadari, Luminate Security/Symantec)|
|12:00-13:00|Pause déjeuner|
|13:00-14:30|!"The Cloud First Strategy to Enable the Italian Government Digitalization" (Dr. Nicola Sfondrini, Cloud Security Alliance)|
|~|!"The State of Auditing and Forensics Activities in Spain" (Ivan Robles, SOTHIS)|
|~|!"Security @ Internet Cloud Based Companies" (Eitan Satmary, Wix.com)|
|14:30-15:00|Pause|
|15:00-16:15|!"Blockchain & Cloud" (Jim Reavis, Cloud Security Alliance)|
|~|!"Cloud Octagon model: Cloud Security Risk Management in Financial Services" (Olaf Streutker, ABN AMRO Bank)|
|16:15-16:30|Conclusion : Jim Reavis, Yuval Segev, Jairo Orea|
Pour le programme détaillé et s'incrire :
* Lien → ''[[CloudSecurityAlliance.fr/go/j6oP/|https://cloudsecurityalliance.fr/go/j6oP/]]''
* Lien → ''[[CloudSecurityAlliance.fr/go/j6oE/|https://cloudsecurityalliance.fr/go/j6oE/]]''
!"//Cloud Octagon Model//"
[>img(150px,auto)[iCSA_/C8M.png]]Une approche pour évaluer les risques dans le SaaS.
<<<
//Ce livre blanc s'inspire des défis de sécurité dans les environnements Cloud et propose une approche logique pour traiter les aspects de sécurité d'une manière holistique en introduisant le "Modèle Octogonal du Cloud" (ou //Cloud Octagon Model//) . Ce modèle facilite l'identification, la représentation et l'évaluation des risques dans le contexte de la mise en œuvre de l'informatique dématérialisée par de multiples acteurs (juridique, gestion des risques liés à l'information, gestion des risques opérationnels, conformité, architecture, approvisionnement, protection des données personnelles, équipes de développement et de sécurité).//
[...]
//Les objectifs de ce modèle sont de réduire les risques associés à l'informatique dans le Cloud, d'améliorer l'efficacité de l'équipe de gestion des risques, d'améliorer la gestion de la solution et enfin, d'améliorer encore la sécurité.//
[...]
//Le livre blanc traite des 60 contrôles de sécurité inclus dans le modèle et qui sont répartis sur les faces de l'octogone.//
[...]
//Les 8 dimensions sont les suivantes ://
* //Core Functions//
* //Data Classification//
* //Countries//
* //Procurement//
* //IT Governance//
* //Service Model//
* //Deployment & Engineering//
* //Sub Service Providers//
La représentation de l'octogone en : +++*[plus large »]> [img(600px,auto)[iCSA_/OctogonModel.png]] === 
<<<
* Communiqué de presse → ''[[CloudSecurityAlliance.fr/go/j6oa/|https://cloudsecurityalliance.fr/go/j6oa/]]''
* Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j6oo/|https://cloudsecurityalliance.fr/go/j6oo/]]''
!"//How to Improve the Accuracy and Completeness of Cloud Computing Risk Assessments?//"
[>img(150px,auto)[iCSA_/C8M.png]]Article de blog publié le 24 juin 2019 — Rédigé par Jim de Haas, cloud security expert, ABN AMRO Bank.
<<<
//Ce livre blanc s'inspire des défis de sécurité dans les environnements Cloud et propose une approche logique pour traiter les aspects de sécurité d'une manière holistique en introduisant le "Modèle Octogonal du Cloud" (ou //Cloud Octagon Model//) . Ce modèle facilite l'identification, la représentation et l'évaluation des risques dans le contexte de la mise en œuvre de l'informatique dématérialisée par de multiples acteurs (juridique, gestion des risques liés à l'information, gestion des risques opérationnels, conformité, architecture, approvisionnement, protection des données personnelles, équipes de développement et de sécurité).//
[...]
//Les objectifs de ce modèle sont de réduire les risques associés à l'informatique dans le Cloud, d'améliorer l'efficacité de l'équipe de gestion des risques, d'améliorer la gestion de la solution et enfin, d'améliorer encore la sécurité.//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/06/24/how-to-improve-the-accuracy-and-completeness-of-cloud-computing-risk-assessments/]] sur le blog de la CSA
* Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j6oo/|https://cloudsecurityalliance.fr/go/j6oo/]]''
|!Juin|!Sources|!Titres et Liens|!Synthèses|
|2019.06.24|CSA|[[Cloud Security Alliance Releases Cloud Octagon Model to Facilitate Cloud Computing Risk Assessment|https://cloudsecurityalliance.org/articles/csa-releases-cloud-octagon-model-to-facilitate-cloud-computing-risk-assessment/]]|Innovative model challenges enterprises to investigate risk from perspective other than that of the cloud service provider|
!1 - Les nouveautés CSA de la semaine du 17 au 23 juin 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Conférence : Prolongation d'un mois de l'appel à présentations pour le CSA Congress EMEA 2019+++*[»]> <<tiddler [[2019.06.21 - Actu : Encore un mois pour soumettre un sujet au CSA Congress EMEA 2019]]>>=== 
* Appels à commentaires : "''Agile Security: The Integration of Security, Development and Operations''"+++*[»]> <<tiddler [[2019.06.18 - Actu : Appel à commentaires, document 'Agile Security: The Integration of Security, Development and Operations']]>>=== 
* Blog : "''La cryptographie hybride pour contrer la menace quantique''"+++*[»]> <<tiddler [[2019.06.17 - Blog : La cryptographie hybride pour contrer la menace quantique]]>>=== 
* Publication : "''Mitigating the Quantum Threat with Hybrid Cryptography''"+++*[»]> <<tiddler [[2019.06.17 - Publication : Mitigating the Quantum Threat with Hybrid Cryptography]]>>=== 
!2 - Veille Web
La [[Veille Web|2019.06.23 - Veille Hebdomadaire]] avec une cinquantaine de liens dont :
* Supervision Azure et O365
* Liste de contrôles pour tests d'intrusion dans le Cloud
* Microsoft interdirait à ses employés d'utiliser certains services Cloud
* Cloud et défense en profondeur
* Rapport : McAfee "Cloud Adoption and Risk Report"
* Divers : menaces, pannes, Kubernetes, Azure/AWS/GCP...
!3 - Agenda
* ''24 juin'' : ''CSA EMEA Summit'' à Tel Aviv+++*[»]> <<tiddler [[2019.06.24 - CSA EMEA Summit 2019 - Tel Aviv]]>>=== 
* ''28 __juillet__'' : clôture de l'appel à présentations pour le ''CSA Congress EMEA'' des 20 et 21 novembre 2019 à Berlin+++*[»]> <<tiddler [[2019.06.21 - Actu : Encore un mois pour soumettre un sujet au CSA Congress EMEA 2019]]>>=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Juin|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.06.23|
|2019.06.23|Protego|[[Lock-Ins vs. Cloud-Agnostic|https://www.protego.io/serverless-show-lock-ins-vs-cloud-agnostic/]]|Serverless IAM|
|2019.06.23|Steve Gathof|[[Deploying a Honeypot on AWS|https://medium.com/@sudojune/deploying-a-honeypot-on-aws-5bb414753f32]]|Detection AWS HoneyPot|
|>|>|>|!2019.06.22|
|2019.06.22|CloudWeek Paris|[[Sélectionner son prestataire cloud : la check-list|https://cloudweek.paris/fr/selectionner-son-prestataire-cloud-la-check-list/]]|Providers|
|2019.06.22|Analytics Insight|[[Here is the Secret Behind Getting that Cloud Computing Job|https://www.analyticsinsight.net/here-is-the-secret-behind-getting-that-cloud-computing-job/]]|Jobs|
|>|>|>|!2019.06.21|
|2019.06.21|GBHackers on Security|![[Cloud Computing Penetration Testing Checklist & Important Considerations|https://gbhackers.com/cloud-computing-penetration-testing-checklist-important-considerations/]]|PenTest|
|2019.06.21|DZone|[[What Is a Container, Anyway?|https://dzone.com/articles/what-is-a-container-anyway-born-sql]]|Containers|
|2019.06.21|DZone|[[A Production-Ready Checklist for Kubernetes|https://dzone.com/articles/a-production-ready-checklist-for-kubernetes]]|Kubernetes|
|2019.06.21|Infosec Island|[[Today's Top Public Cloud Security Threats …And How to Thwart Them|http://www.infosecisland.com/blogview/25203-Todays-Top-Public-Cloud-Security-Threats-And-How-to-Thwart-Them.html]]|Threats|
|2019.06.21|GeekWire|[[No Slack for you! Microsoft puts rival app on internal list of 'prohibited and discouraged' software|https://www.geekwire.com/2019/no-slack-microsoft-puts-rival-app-internal-list-prohibited-discouraged-software/]]|Misc|
|2019.06.22|BetaNews|! → [[Leaked: Microsoft bans employees from using Slack, Kaspersky… even GitHub use is discouraged|https://betanews.com/2019/06/22/microsoft-banned-prohibited-list/]]|Misc|
|2019.06.21|TechRepublic|[[How to view your privacy settings for Microsoft Office 365|https://www.techrepublic.com/article/how-to-view-your-privacy-settings-for-microsoft-office-365/]]|O365|
|2019.06.21|Informatique News|[[Qui est responsable de la sécurité du cloud ? (en anglais)|https://www.informatiquenews.fr/qui-est-responsable-de-la-securite-du-cloud-en-anglais-62466]]|Misc|
|2019.06.21|Infosec Island|[[Today's Top Public Cloud Security Threats… And How to Thwart Them|http://www.infosecisland.com/blogview/25203-Todays-Top-Public-Cloud-Security-Threats-And-How-to-Thwart-Them.html]]|Cloud Misc.|
|2019.06.21|//Teradici//|[[Hybrid and Multicloud Deployments: A Survey of Factors Driving Tomorrow's Decisions|https://connect.teradici.com/blog/hybrid-and-multicloud-deployments-survey]]|Report MultiCloud|
|2019.06.21|//Teradici//| → [[The State of Multicloud - Virtual Desktop Deployments in 2019|https://connect.teradici.com/multicloud]]|Report MultiCloud|
|2019.06.21|//Google//|[[Scan your Cloud Storage buckets for sensitive data using Cloud DLP|https://cloud.google.com/blog/products/storage-data-transfer/scan-your-cloud-storage-buckets-for-sensitive-data-using-cloud-dlp]]|DLP|
|2019.06.21|//BitDefender//|[[Office 365 Proves Popular with Phishers|https://businessinsights.bitdefender.com/office-365-proves-popular-with-phishers]]|O365 Phishing|
|>|>|>|!2019.06.20|
|2019.06.20|DevOps|[[The Taxonomy of DataOps|https://devops.com/the-taxonomy-of-dataops/]]|DevOps|
|2019.06.20|DevOps|[[Building a Security Feedback Process for DevOps|https://devops.com/building-a-security-feedback-process-for-devops/]]|DevOps|
|2019.06.20|//Microsoft//|[[Investigating identity threats in hybrid cloud environments|https://www.microsoft.com/security/blog/2019/06/20/investigating-identity-threats-hybrid-cloud-environments/]]|Azure Threats|
|2019.06.20|//Google//|![[Google Cloud networking in depth: three defense-in-depth principles for securing your environment|https://cloud.google.com/blog/products/networking/google-cloud-networking-in-depth-three-defense-in-depth-principles-for-securing-your-environment]]|GCP Architecture|
|2019.06.20|//Google//|[[5 frequently asked questions about Google Cloud Anthos|https://cloud.google.com/blog/topics/hybrid-cloud/5-frequently-asked-questions-about-google-cloud-anthos]]|GCP Anthos|
|2019.06.20|//Protego//|[[Is Serverless Security Really Application Security or Simply New Techniques|https://www.protego.io/serverless-show-is-serverless-security-really-application-security-or-new-techniques/]]|Serverless|
|2019.06.20|//Synopsys//|[[Using the cloud as a cheap DevSecOps lab environment|https://www.synopsys.com/blogs/software-security/devsecops-lab-cloud/]]|DevSecOps|
|2019.06.20|//Heficed//|[[Google Cloud Outages Expose Vulnerability of Major Providers, Underscore Benefits of Niche Cloud Computing Players|https://vmblog.com/archive/2019/06/20/google-cloud-outages-expose-vulnerability-of-major-providers-underscore-benefits-of-niche-cloud-computing-players.aspx]]|Market|
|2019.06.20|//NeuVector//|[[How to Mitigate the SACK Panic DDoS Attack|https://neuvector.com/container-security/mitigate-sack-panic-ddos-attack/]]|CVE-2019-11477|
|2019.06.20|//McAfee//|[[3 Ways to Secure Enterprise Shadow IT|https://www.skyhighnetworks.com/cloud-security-blog/3-ways-to-secure-enterprise-shadow-it/]]|ShadowIT|
|2019.06.20|Security Boulevard|[[Who's Responsible for a Cloud Breach? It Depends|https://securityboulevard.com/2019/06/whos-responsible-for-a-cloud-breach-it-depends/]]|CSA|
|>|>|>|!2019.06.19|
|2019.06.19|AWS Insider|![[Report: Kubernetes May Drive GCP Challenge to AWS Cloud Supremacy Among Developers|https://awsinsider.net/articles/2019/06/19/devops-research.aspx]]|Kubernetes|
|2019.06.19|Digital Insurance|[[Cloud adoptions are obscuring data visibility, says new study|https://www.dig-in.com/news/cloud-adoptions-are-obscuring-data-visibility-says-new-study]]|CSA|
|2019.06.19|DZone|[[Running Local Docker Images in Kubernetes|https://dzone.com/articles/running-local-docker-images-in-kubernetes-1]]|Kubernetes Docker|
|2019.06.19|DZone|[[Docker Swarm or Kubernetes?: Is It the Right Question to Ask?|https://dzone.com/articles/quotdocker-swarm-or-kubernetesquot-is-it-the-right]]|Kubernetes Docker|
|2019.06.19|//OCD-Tech//|[[Don't Let the Cloud Rain on Your DFARS Compliance|https://ocd-tech.com/2018/06/19/dont-let-the-cloud-rain-on-your-dfars-compliance/]]|Compliance|
|>|>|>|!2019.06.18|
|2019.06.18|TechTarget|[[As cloud complexities increase, cybersecurity skills gap worsens|https://searchcloudsecurity.techtarget.com/feature/As-cloud-complexities-increase-cybersecurity-skills-gap-worsens]]|Skills|
|2019.06.18|Solutions Review|[[The Definitive Azure Certification List for Businesses and IT Departments|https://solutionsreview.com/cloud-platforms/the-definitive-azure-certification-list-for-businesses-and-it-departments/]]|Certifications|
|2019.06.18|Dark Reading|[[As Cloud Adoption Grows, DLP Remains Key Challenge|https://www.darkreading.com/cloud/as-cloud-adoption-grows-dlp-remains-key-challenge/d/d-id/1335000]]|DLP|
|2019.06.18|CBR Online|[[Misconfigured Servers Still a Key Risk for Companies Moving to the Cloud|https://www.cbronline.com/news/misconfigured-servers]]|Report|
|2019.06.18|//Diamenti//|[[IT Operations Increasingly Driving Container Use, New Diamanti Survey Shows|https://www.globenewswire.com/news-release/2019/06/18/1870139/0/en/IT-Operations-Increasingly-Driving-Container-Use-New-Diamanti-Survey-Shows.html]] ([[pdf|https://diamanti.com/wp-content/uploads/2019/06/Diamanti_2019_Container_Survey.pdf]])|Report Containers|
|2019.06.18|//Rhino Security Labs//|[[Escalating AWS IAM Privileges with an Undocumented CodeStar API|https://rhinosecuritylabs.com/aws/escalating-aws-iam-privileges-undocumented-codestar-api/]]|Vulnerability|
|2019.06.18|//Summit Route//|[[AWS IAM Managed Policy Review|https://summitroute.com/blog/2019/06/18/aws_iam_managed_policy_review/]]|AWS IAM|
|2019.06.18|//Microsoft//|[[Announcing the preview of Microsoft Azure Bastion|https://azure.microsoft.com/en-us/blog/announcing-the-preview-of-microsoft-azure-bastion/]]|Azure Bastion|
|2019.06.18|//Symantec//|[[4 Things Developers Should Know About Security in the Age of DevSecOps|https://devops.com/4-things-developers-should-know-about-security-in-the-age-of-devsecops/]]|DevSecOps|
|2019.06.18|//PUPUWEB//|[[Business Continuity (BC) / Disaster Recovery (DR) Best Practices in Cloud Computing|https://pupuweb.com/business-continuity-disaster-recovery-cloud/]]|BCP DRP DRaaS|
|2019.06.18|//Armor//|[[Security in the Cloud: Google Cloud Platform|https://www.armor.com/blog/security-in-the-cloud-google-cloud-platform/]]|GCP|
|>|>|>|!2019.06.17|
|2019.06.17|Gouvernement du Canada |![[Stratégie d'adoption de l'informatique en nuage du gouvernement du Canada : Mise à jour de 2018|https://www.canada.ca/fr/gouvernement/systeme/gouvernement-numerique/technologiques-modernes-nouveaux/services-informatique-nuage/strategie-adoption-information-nuage-gouvernement-canada.html]]|Government Canada|
|2019.06.17|Government of Canada | → [[Government of Canada Cloud Adoption Strategy: 2018 update|https://www.canada.ca/en/government/system/digital-government/modern-emerging-technologies/cloud-services/government-canada-cloud-adoption-strategy.html]]|Government Canada|
|2019.06.17|0x00sec|![[A Blue Team guide to Azure & Office 365 monitoring|https://0x00sec.org/t/a-blue-team-guide-to-azure-office-365-monitoring/14411/]]|Azure O365 Minitoring|
|2019.06.17|DZone|[[Routing External Traffic Into Your Kubernetes Services|https://dzone.com/articles/routing-external-traffic-into-your-kubernetes-serv]]|Kubernetes|
|2019.06.17|UK Authòrity|[[MoJ creates security baseline for Amazon cloud|https://www.ukauthority.com/articles/moj-creates-security-baseline-for-amazon-cloud/]]|AWS baseline|
|2019.06.14|GOV.uk|! → [[Security baseline in the Public Cloud|https://mojdigital.blog.gov.uk/2019/06/14/security-baseline-in-the-public-cloud/]]|AWS baseline|
|2019.06.17|TechRepublic|[[How to create an administrator IAM user and group in AWS|https://www.techrepublic.com/article/how-to-create-an-administrator-iam-user-and-group-in-aws/]]|AWS IAM|
|2019.06.17|Brian Warehime|[[Nights Watch - Zero to Hero with AWS GuardDuty|https://medium.com/@brianwarehime_79186/nights-watch-zero-to-hero-with-aws-guardduty-84c8e343c6a4]]|AWS|
|2019.06.17|Javier Olmedo|[[Deploy a private Burp Collaborator Server in Azure|https://medium.com/bugbountywriteup/deploy-a-private-burp-collaborator-server-in-azure-f0d932ae1d70]]|Azure Assessment|
|2019.06.17|CRN|[[The biggest Microsoft Azure security issues you need to know about|https://www.crn.com.au/news/the-biggest-microsoft-azure-security-issues-you-need-to-know-about-526789]]|Azure|
|2019.06.17|CRN|[[The top six cloud security threats to know about in 2019|https://www.crn.com.au/news/the-top-six-cloud-security-threats-to-know-about-in-2019-526779]]|Threats|
|2019.06.17|Solutions Numériques|[[La sécurité juridique du Cloud|https://www.solutions-numeriques.com/dossiers/la-securite-juridique-du-cloud/]]|Legal|
|2019.06.17|DevOps.com|[[Lessons Learned from the Salesforce Outage|https://devops.com/lessons-learned-from-the-salesforce-outage/]]|Outage|
|2019.06.17|Medium|[[Docker Security : Backdooring Images with Dockerscan|https://medium.com/@mayankshah_85820/docker-security-backdooring-images-with-dockerscan-ace5ff65bd39]]|Docker Backdooring|
|2019.06.17|//CompliantCloud//|[[Data Integrity Challenges and the Cloud|https://compliantcloud.com/data-integrity-challenges-and-the-cloud/]]|Integrity|
|2019.06.17|//McAfee//|![[Cloud Adoption and Risk Report - Business Growth Edition|https://www.mcafee.com/enterprise/en-us/solutions/lp/cloud-adoption-risk-report-business-growth-edition.html]]|Report|
|2019.06.18|CBR Online| → [[Misconfigured Servers Still a Key Risk for Companies Moving to the Cloud|https://www.cbronline.com/news/misconfigured-servers]]|Report|
|2019.06.20|InfoSecurity Mag| → [[Only Quarter of IaaS Users Can Audit Config Settings|https://www.infosecurity-magazine.com/news/quarter-iaas-users-can-audit-1-1/]]|Report|
|2019.06.21|TechWire Asia| → [[The average enterprise organization now uses 1,935 cloud services|https://techwireasia.com/2019/06/the-average-enterprise-organization-now-uses-1935-cloud-services/]]|Misc|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Juin 2019]]>>
!Prolongation d'un mois de l'appel à présentations pour le CSA Congress EMEA 2019
[>img(200px,auto)[iCSF/EasyChair.png][https://cloudsecurityalliance.fr/go/jBjs/]]La date limite pour soumettre un sujet de présentation est reporté jusqu'au ''28 juillet 2019''.
Les propositions doivent être soumises sur le site [[EasyChair|https://cloudsecurityalliance.fr/go/jBjs/]], après création d'un compte utilisateur sur cette plate-forme de référence.

Lien pour soumettre une présentation :
* Lien → ''[[CloudSecurityAlliance.fr/go/jBjs/|https://cloudsecurityalliance.fr/go/jBjs/]]''
Lien vers l'annonce du report :
* Lien → ''[[CloudSecurityAlliance.fr/go/j6ld/|https://cloudsecurityalliance.fr/go/j6ld/]]''

Rappel : le ''CSA Congress EMEA'' se déroulera à Berlin les 20 et 21 novembre 2019+++*[»]> <<tiddler [[2019.11.20 - CSA Congress EMEA 2019 - Berlin]]>>=== 
[>img(100px,auto)[iCSA/CSAdoc.png]]Un appel à commentaires dont la date de clôture est le ''26 juin 2019'' : "''Agile Security: The Integration of Security, Development and Operations''".
<<<
//With the confusion of terminology surrounding the practice of integrating security into DevOps, many businesses fall short of being able to implement it into their modern culture. This whitepaper aims to clarify and standardize an authoritative definition of the intersection between the three aspects of security, development and operations, and use it to generalize the principles of a novel security management approach we call "Agile Security".//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j6iA/|https://cloudsecurityalliance.fr/go/j6iA/]]''



[img(25%,1px)[iCSF/BluePixel.gif]]
Article de blog publié le 17 juin — Rédigé par Roberta Faux, Director of Advance Cryptography, BlackHorse Solution
<<<
//[>img(200px,auto)[iCSA/J6HBM.png]]Our new white paper explains the pros and cons of hybrid cryptography. The CSA Quantum-Safe Security Working Group has produced a new primer on hybrid cryptography. This paper, "Mitigating the Quantum Threat with Hybrid Cryptography," is aimed at helping non-technical corporate executives understand how to potentially address the threat of quantum computers on an organization's infrastructure. Topics covered include://
* //Types of hybrids//
* //Cost of hybrids//
* //Who needs a hybrid//
* //Caution about hybrids//
[...]
//__Conclusion__
The migration to quantum resistance is going to be a challenge. It is vital that corporate leaders plan for this now. Organizations need to start asking the following questions://
* //How is your organization dependent on cryptography?//
* //How long does your data need to be secure?//
* //How long will it take you to migrate?//
* //Have you ensured you fully understand the ramifications of migration?//
//Well-informed planning will be key for a smooth transition to quantum-resistant security. Organizations need to start to conduct experiments now to determine unforeseen impacts. Importantly, organizations are advised to seek expert advice so that their migration doesn't introduce new vulnerabilities.
As you prepare your organization to secure against future threats from quantum computers, make sure to do the following://
* //Identify reliance on cryptography//
* //Determine risks//
* //Understand options//
* //Perform a proof of concept//
* //Make a plan//
<<<
* +++*[Détails complémentaires »]> <<tiddler [[2019.06.17 - Publication : Mitigating the Quantum Threat with Hybrid Cryptography]]>>=== 
* &rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/06/17/hybrid-cryptography-quantum-threat/]] sur le blog de la CSA
!"//Mitigating the Quantum Threat with Hybrid Cryptography//"
<<<
[>img(150px,auto)[iCSA/J6HBM.png]]//Focus of this document is on four hybrid cryptographic schemes which provide both classical security of classical crypto and the quantum security of a quantum-safe system. This document will also provide a background on quantum security and an overview of hybrid schemes.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j6hq/|https://cloudsecurityalliance.fr/go/j6hq/]]''





!1 - Les nouveautés CSA de la semaine du 10 au 16 juin 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : "''Top 20 des contrôles pour les ERP dans le Cloud''"+++*[»]> <<tiddler [[2019.06.10 - Blog : Top 20 des contrôles pour les ERP dans le Cloud]]>>=== 
* Publication : "''Top 20 Critical Controls for Cloud Enterprise Resource Planning (ERP) Customers''"+++*[»]> <<tiddler [[2019.06.10 - Publication : Top 20 Critical Controls for Cloud Enterprise Resource Planning (ERP) Customers]]>>=== 
* Appels à commentaires : "''Top Threats to Cloud Computing 2019''"+++*[»]> <<tiddler [[2019.06.11 - Actu : Appel à commentaires, document 'Top Threats to Cloud Computing 2019']]>>=== 
* Appels à commentaires : "''CSA CCM v3.0.1 Addendum - AICPA TSC 2017''"+++*[»]> <<tiddler [[2019.06.11 - Actu : Appel à commentaires, document 'CSA CCM v3.0.1 Addendum - AICPA TSC 2017']]>>=== 
* Appels à commentaires : "''CSA CCM v3.0.1 Addendum - NIST 800-53 Rev 4 Moderate''"+++*[»]> <<tiddler [[2019.06.11 - Actu : Appel à commentaires, document 'CSA CCM v3.0.1 Addendum - NIST 800-53 Rev 4 Moderate']]>>=== 
* Appels à commentaires : "''CCM v3.0.1 Addendum - Guideline on Effectively Managing Security Services in the Cloud''"+++*[»]> <<tiddler [[2019.06.14 - Actu : Appel à commentaires, document 'CCM v3.0.1 Addendum - Guideline on Effectively Managing Security Services in the Cloud']]>>=== 
* Appels à commentaires : "''Gap Analysis Report on Mapping CCM with Guideline on Effectively Managing Security Service in the Cloud''"+++*[»]> <<tiddler [[2019.06.14 - Actu : Appel à commentaires, document 'Gap Analysis Report on Mapping CCM with Guideline on Effectively Managing Security Service in the Cloud']]>>=== 
!2 - Veille Web
Alerte de sécurité
* CVE-2019-0996: //Azure DevOps Server Spoofing Vulnerability//+++*[»]> <<tiddler [[2019.06.30.Alert]]>>=== 
La [[Veille Web|2019.06.16 - Veille Hebdomadaire]] avec une soixantaine de liens dont :
* Docker : le botnet AESDDoS qui s'infiltre via les API
* Vulnérabilité BlueKeep et Cloud
* AWS S3 et ransomware
* SOC-as-a-Service, DevSecOps
!3 - Agenda
* ''24 juin'' : ''CSA EMEA Summit'' à Tel Aviv+++*[»]> <<tiddler [[2019.06.24 - CSA EMEA Summit 2019 - Tel Aviv]]>>=== 
* ''28 juin'' : clôture de l'appel à présentations pour le ''CSA Congress EMEA'' des 20 et 21 novembre 2019 à Berlin+++*[»]> <<tiddler [[2019.03.30 - CSA Congress EMEA 2019 - Appel à présentations]]>>=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Juin|!Sources|!Titres et Liens|!Keywords|
|2019.06.16|SecurityAffairs|[[Linux worm spreading via Exim servers hit Azure customers|https://securityaffairs.co/wordpress/87168/hacking/linux-worm-exim-servers.html]]|Attacks Azure|
|2019.06.16|//Cloudflare//|[[Security Compliance at Cloudflare|https://blog.cloudflare.com/security-compliance-at-cloudflare/]]|Compliance|
|2019.06.16|//Tripwire//|[[Adding to the Toolkit - Some Useful Tools for Cloud Security|https://www.tripwire.com/state-of-security/security-data-protection/cloud/useful-tools-cloud-security/]]|Misc|
|>|>|>|!|
|2019.06.14|Journal du Net[>img[iCSF/flag_fr.png]]|[[Mieux comprendre le Cloud Act et ses enjeux|https://www.journaldunet.com/solutions/expert/71263/mieux-comprendre-le-cloud-act-et-ses-enjeux.shtml]]|Cloud_Act|
|2019.06.14|ITpro[>img[iCSF/flag_fr.png]]|[[L'adoption mondiale du Cloud dans les entreprises|https://www.itpro.fr/ladoption-mondiale-du-cloud-dans-les-entreprises/]]|Misc|
|2019.06.14|DZone|[[Routing external traffic into your Kubernetes services |https://dzone.com/articles/routing-external-traffic-into-your-kubernetes-serv]]|Kubernetes|
|2019.06.14|SafeControl|![[CCSK Domain 3: Legal and contractual issues|https://safecontrols.blog/2019/06/14/ccsk-domain-3-legal-and-contractual-issues/]]|CCSK|
|2019.06.14|The Register|[[You'll always need VMs says, surprise, VMware: Run on any cloud you like and get portability|https://www.theregister.co.uk/2019/06/14/youll_always_need_vms_says_errm_vmware/]]|VM|
|2019.06.14|DevOps.com|[[Portable Security Policies: A DevSecOps Primer|https://devops.com/portable-security-policies-a-devsecops-primer/]]|DevSecOps|
|2019.06.14|Channel Future|[[Understanding container-based automation and proofs of concept are capabilities of even small security teams.|https://www.channelfutures.com/security/containers-and-cybersecurity-ansible-kubernetes-more-to-consider]] ([[code|https://github.com/InteropDemo/interop19-docker]])|Containers Automation|
|2019.06.14|//Microsoft//|[[Prevent the impact of a Linux worm by updating Exim (CVE-2019-10149)|https://blogs.technet.microsoft.com/msrc/2019/06/14/prevent-the-impact-of-a-linux-worm-by-updating-exim-cve-2019-10149/]]|Attacks Azure|
|2019.06.14|//Trendmicro//|[[AESDDoS Botnet Malware Infiltrates Containers via Exposed Docker APIs|https://blog.trendmicro.com/trendlabs-security-intelligence/aesddos-botnet-malware-infiltrates-containers-via-exposed-docker-apis/]]|Attacks Docker|
|2019.06.14|Bleeping Computer| → [[Exposed Docker APIs Abused by DDoS, Cryptojacking Botnet Malware|https://www.bleepingcomputer.com/news/security/exposed-docker-apis-abused-by-ddos-cryptojacking-botnet-malware/]]|Attacks Docker|
|2019.06.14|//Whistic//|[[Phase 2 of The 5 Phases of Responding to a Security Questionnaire & How to Get Proactive (2/5)|https://blog.whistic.com/phase-2-of-the-5-phases-of-responding-to-a-security-questionnaire-how-to-get-proactive-d35a839a4a3f]]|Misc|
|>|>|>|!|
|2019.06.13|disruptOps|[[The 3-Step Process to Start Monitoring Your AWS Cloud Environments|https://disruptops.com/the-3-step-process-to-start-monitoring-your-aws-cloud-environments/]]|AWS Monitoring|
|2019.06.13|SecurityWeek|[[Security First in the Cloud Wars|https://www.securityweek.com/security-first-cloud-wars]]|Misc|
|2019.06.13|Redmond Channel Partner|[[New Features Added to Microsoft 365 Business Subscriptions|https://rcpmag.com/articles/2019/06/13/microsoft-365-business-features.aspx]]|O365|
|2019.06.13|DevOps.com|[[How to Automate an API Security Program Without Adding Staff|https://devops.com/how-to-automate-an-api-security-program-without-adding-staff/]]|DevOps API|
|2019.06.13|DevOps.com|[[The DevOps Security Stack|https://devops.com/the-devops-security-stack/]]|SecDevOps|
|2019.06.13|//Microsoft//|![[Three ways to get notified about Azure service issues|https://azure.microsoft.com/en-us/blog/three-ways-to-get-notified-about-azure-service-issues/]]|Azure Notification|
|2019.06.13|//Caylent//|[[Examining Kubernetes Persistent Volumes|https://caylent.com/examining-kubernetes-persistent-volumes/]]|Kubernetes|
|2019.06.13|//Lacework//|[[Cloud Controls to Major Tom: A Quick Guide to Configuration as a Security Measure|https://www.lacework.com/cloud-configuration-security/]]|Controls|
|2019.06.13|//Armor//|[[Security in the Cloud: Azure|https://www.armor.com/blog/security-in-the-cloud-azure/]]|Azure|
|2019.06.13|//DeltaRisk//|![[SOC-as-a-Service Overview: Improving AWS and Azure Security (2/2)|https://deltarisk.com/blog/soc-as-a-service-overview-aws-azure-security/]]|SOC|
|2019.06.13|//Zscaler//|[[New Zscaler Study Reveals Legacy Networks Continue to Strain Office 365 Deployments|https://vmblog.com/archive/2019/06/13/new-zscaler-study-reveals-legacy-networks-continue-to-strain-office-365-deployments.aspx]] ([[rapport|https://info.zscaler.com/resources-ebooks-2019-office-365-migration-survey]])|Report O365|
|2019.06.13|//Trendmicro//|[[Outlaw Hacking Group's Botnet Observed Spreading Miner, Perl-Based Backdoor|https://blog.trendmicro.com/trendlabs-security-intelligence/outlaw-hacking-groups-botnet-observed-spreading-miner-perl-based-backdoor/]]|Attacks|
|2019.06.13|//Tresorit//|[[7 Tips for Building a Winning Cloud Migration Strategy|https://tresorit.com/blog/7-tips-for-a-winning-cloud-migration-strategy/]]|Migration|
|2019.06.13|IDG Connect|[[The Secret CSO: Nils Puhlmann, Twilio|https://www.idgconnect.com/interviews/1502058/secret-cso-nils-puhlmann-twilio]]|CSA|
|>|>|>|!|
|2019.06.12|disruptOps|![[AWS vs. Azure vs. GCP: A Security Pro's Quick Comparison|https://disruptops.com/aws-vs-azure-vs-gcp-a-security-pros-quick-cloud-comparison/]]|AWS Azure GCP|
|2019.06.12|DZone|[[5 Lessons from the Google Cloud Outage|https://dzone.com/articles/5-lessons-from-the-google-cloud-outage]]|Outage GCP|
|2019.06.12|DZone|[[Squash Threats and Master the Tenets of Kubernetes Deployment Security|https://dzone.com/articles/quash-threats-and-master-the-tenets-of-kubernetes-1]]|Kubernetes|
|2019.06.12|Bleeping Computer|![[Microsoft 365 Business Adds Granular Controls to Company Assets|https://www.bleepingcomputer.com/news/security/microsoft-365-business-adds-granular-controls-to-company-assets/]]|O365|
|2019.06.12|CBR Online|[[Metropolitan Police to Use Azure for "Digital Investigation Processes"|https://www.cbronline.com/news/metropolitan-police-microsoft]]|Azure|
|2019.06.12|CyberScoop|[[Cybersecurity has done more to drive government cloud use than any other feature, intel official says|https://www.cyberscoop.com/sue-gordon-odni-cybersecurity-cloud-computing-amazon-web-services/]]|Government|
|2019.06.12|IT World|[[Cisco offers cloud-based security for SD-WAN resources|https://www.itworld.com/article/3402079/cisco-offers-cloud-based-security-for-sd-wan-resources.html]]|SDWAN Cisco|
|2019.06.12|Security Boulevard|[[Tips for Achieving Secure Cloud Access|https://securityboulevard.com/2019/06/tips-for-achieving-secure-cloud-access/]]|Access Controls|
|2019.06.12|//3DS Outscale//[>img[iCSF/flag_fr.png]]|[[3DS OUTSCALE renforce son contrôle des accès à privilèges grâce à One Identity|http://www.globalsecuritymag.fr/3DS-OUTSCALE-renforce-son-controle,20190612,88060.html]]|IAM|
|2019.06.12|//AppDynamics//|[[Single vs. Multi-Tenant Cloud Architecture: The Value of Multi-Tenancy|https://www.appdynamics.com/blog/engineering/multi-tenant-cloud-architecture/]]|MultiTenancy|
|2019.06.12|//Fortinet//|[["BlueKeep" Vulnerability (CVE-2019-0708) within Cloud/Datacenter Machines: How to Safeguard Yourself?|https://www.fortinet.com/blog/threat-research/bluekeep-vulnerability-cloud-datacenters.html]]|BlueKeep CVE-2019-0706|
|2019.06.12|//Microsoft//|[[Using Azure AD with your Oracle Cloud apps|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Using-Azure-AD-with-your-Oracle-Cloud-apps/ba-p/683915]]|AzureAD|
|2019.06.12|//Microsoft//|[[Ensuring security of your Microsoft Teams apps with Microsoft Cloud App Security|https://www.microsoft.com/security/blog/2019/06/12/ensuring-security-microsoft-teams-apps-microsoft-cloud-app-security/]]|Azure|
|2019.06.12|//Aqua Security//|![[How to track security problems in your Kubernetes deployments|https://techbeacon.com/security/how-track-security-problems-your-kubernetes-deployments]]|Kubernetes|
|2019.06.12|Security Boulevard|[[Poor Cloud Security Practices Put Data at Risk; A Detailed Look at How Hackers Target Employees|https://securityboulevard.com/2019/06/poor-cloud-security-practices-put-data-at-risk-a-detailed-look-at-how-hackers-target-employees/]]|CSA|
|2019.06.12|Network World|[[Software Defined Perimeter (SDP): Creating a new network perimeter|https://www.networkworld.com/article/3402258/software-defined-perimeter-sdp-creating-a-new-network-perimeter.html]]|CSA|
|>|>|>|!|
|2019.06.11|disruptOps|[[So, You Want to Start Monitoring Your AWS Account?|https://disruptops.com/so-you-want-to-start-monitoring-your-aws-account/]]|AWS Monitoring|
|2019.06.11|SecurityWeek|[[The Symbiosis Between Public Cloud and MSSPs|https://www.securityweek.com/symbiosis-public-cloud-and-mssps]]|Public_Cloud|
|2019.06.11|DZone|[[Solving for Endpoint Compliance in a Cloud-First Landscape|https://dzone.com/articles/solving-for-endpoint-compliance-in-a-cloud-first-l]]|Compliance|
|2019.06.11|DZone|[[Dockerless, Part 2: How To Build Container Image for Rails Application Without Docker and Dockerfile (2/2)|https://dzone.com/articles/dockerless-part-2-how-to-build-container-image-for]]|Docker|
|2019.06.11|DZone|[[Deconstructing Serverless Computing Part 3: Ninety-Nine Platforms, But How Do You Choose One?|https://dzone.com/articles/deconstructing-serverless-computing-part-3-ninety?fromrel=true]]|Serverless|
|2019.06.11|//AWS//|![[New Version of AWS Security Fundamentals Digital Course Now Available|https://aws.amazon.com/about-aws/whats-new/2019/06/new-version-of-aws-security-fundamentals-digital-course-now-available/]] ([[inscription|https://www.aws.training/learningobject/wbc?id=34259]])|Training|
|2019.06.11|//DeltRisk//|[[What Defines a Modern SOC-as-a-Service Solution? (1/2)|https://deltarisk.com/blog/part-i-what-defines-a-modern-soc-as-a-service-solution/]]|SOC|
|2019.06.11|ITweb ZA|[[Demystifying cloud cyber security|https://www.itweb.co.za/content/mQwkoq6KbOYv3r9A]]|Risks|
|2019.06.11|//LogRhythm//|[[The Top Five Benefits of Cloud SIEM, According to Security Experts|https://logrhythm.com/blog/the-top-five-benefits-of-cloud-siem/]]|SIEM|
|2019.06.11|//Armor//|[[Security in the Cloud: AWS|https://www.armor.com/blog/security-in-the-cloud-aws/]]|AWS|
|2019.06.11|CSO Online|[[The dirty dozen: 12 top cloud security threats|https://www.csoonline.com/article/3043030/the-dirty-dozen-12-top-cloud-security-threats.html]]Threats|
|2019.06.11|SecurityWeek|[[The Symbiosis Between Public Cloud and MSSPs|https://www.securityweek.com/symbiosis-public-cloud-and-mssps]]|MSSPs|
|2019.06.11|//Microsoft//|[[4 best practices to help you integrate security into DevOps|https://www.microsoft.com/security/blog/2019/06/11/4-best-practices-help-you-integrate-security-into-devops/]]|DevOps|
|2019.06.11|//Rhino Security Labs//|![[S3 Ransomware Part 2: Prevention and Defense (2/2)|https://rhinosecuritylabs.com/aws/s3-ransomware-part-2-prevention-and-defense/]]|AWS Ransomware|
|2019.06.11|//Rhino Security Labs//|![[S3 Ransomware Part 1: Attack Vector (1/2)|https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/]]|AWS Ransomware|
|2019.06.11|CSO Online|[[The dirty dozen: 12 top cloud security threats|https://www.csoonline.com/article/3043030/the-dirty-dozen-12-top-cloud-security-threats.html]]|CSA|
|2019.06.11|CRN|[[7 Must-Have Cloud Security Certifications In 2019|https://www.crn.com/slide-shows/cloud/7-must-have-cloud-security-certifications-in-2019/3]]|CSA|
|>|>|>|!|
|2019.06.10|SSTIC[>img[iCSF/flag_fr.png]]|[[Everybody be cool, this is a robbery!|https://www.sstic.org/2019/presentation/hsm/]]|HSM|
|2019.06.10|SSTIC[ → >img[iCSF/flag_fr.png]]|[[Everybody be cool, this is a robbery!|https://www.sstic.org/media/SSTIC2019/SSTIC-actes/hsm/SSTIC2019-Article-hsm-campana_bedrune.pdf]] ([[slides|https://www.sstic.org/media/SSTIC2019/SSTIC-actes/hsm/SSTIC2019-Slides-hsm-campana_bedrune.pdf]])|HSM|
|2019.06.10|ZDnet| → [[Major HSM vulnerabilities impact banks, cloud providers, governments|https://www.zdnet.com/article/major-hsm-vulnerabilities-impact-banks-cloud-providers-governments/]]|HSM|
|2019.06.08|ZDnet| → [[How Ledger Hacked an HSM|https://cryptosense.com/blog/how-ledger-hacked-an-hsm]]|HSM|
|2019.06.10|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[Quand la collaboration cloud mène à un cauchemar de sécurité|https://www.lemondeinformatique.fr/actualites/lire-quand-la-collaboration-cloud-mene-a-un-cauchemar-de-securite-75561.html]]|Risks|
|2019.06.10|DZone|[[From a Swarm of Devices to A Cloud: A Hands-On Experience With Automated Testing in A Visual Studio App Center|https://dzone.com/articles/from-a-swarm-of-devices-to-a-cloud-a-hands-on-expe]]|Misc|
|2019.06.10|TechRepublic|[[Stop ignoring hybrid cloud security risks|https://www.techrepublic.com/article/stop-ignoring-hybrid-cloud-security-risks/]]|Risks|
|2019.06.10|//Kaspersky//|[[How spammers use Google services|https://www.kaspersky.com/blog/spam-through-google-services/27228/]]|Attacks GCP|
|2019.06.10|//eXemplify//|[[The Evolution of Cloud Security: Knowing the Risks and Impact of Breaches|http://www.exemplifygroup.com/the-evolution-of-cloud-security-knowing-the-risks-and-impact-of-breaches/]]|CSA|
|2019.06.10|//Vectra//|[[How to gain visibility into attacker behaviors inside cloud environments|https://blog.vectra.ai/blog/how-to-gain-visibility-into-attacker-behaviors-inside-cloud-environments]]|Attacks|
|2019.06.10|//Fugue//|[[Addressing Cloud Security with Infrastructure Baselines|https://www.fugue.co/blog/addressing-cloud-security-with-infrastructure-baselines]]|Baselines|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Juin 2019]]>>
[>img(100px,auto)[iCSA/CSAdoc.png]]Un appel à commentaires dont la date de clôture est le ''19 juillet 2019'' : "''Gap Analysis Report on Mapping CSA's Cloud Controls Matrix to 'Guideline on Effectively Managing Security Service in the Cloud'''".
<<<
//This document is an addendum to the Cloud Controls Matrix (CCM) V3.0.1 controls. It contains the additional controls that serves to bridge the gap between CCM and the controls within 'Guideline on Effectively Managing Security Services in the Cloud' published by Cloud Security Services Working Group.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j6eM/|https://cloudsecurityalliance.fr/go/j6eM/]]''



[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(100px,auto)[iCSA/CSAdoc.png]]Un appel à commentaires dont la date de clôture est le ''19 juillet 2019'' : "''Gap Analysis Report on Mapping CSA's Cloud Controls Matrix to 'Guideline on Effectively Managing Security Service in the Cloud'''".
<<<
//The report summarizes the mapping of CCM v3.0.1 to 'Guideline on Effectively Managing Security Services in the Cloud' and provides gap analysis on the results.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j6eG/|https://cloudsecurityalliance.fr/go/j6eG/]]''



[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(100px,auto)[iCSA/CSAdoc.png]]Un appel à commentaires dont la date de clôture est le ''7 juillet 2019'' : "Top Threats to Cloud Computing 2019".
<<<
//The report provides organizations with an up-to-date, expert-informed understanding of cloud security concerns in order to make educated risk-management decisions regarding cloud adoption strategies.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j6bT/|https://cloudsecurityalliance.fr/go/j6bT/]]''



[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(100px,auto)[iCSA/CSAdoc.png]]Un appel à commentaires dont la date de clôture est le ''4 juillet 2019'' : "CSA CCM v3.0.1 Addendum - AICPA TSC 2017".
<<<
//This document aims to determine the extent to which an AICPA TSC 2017 compliant organization can meet CCM requirements. The document contains controls mappings and gap analysis.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j6bA/|https://cloudsecurityalliance.fr/go/j6bA/]]''



[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(100px,auto)[iCSA/CSAdoc.png]]Un appel à commentaires dont la date de clôture est le ''29 juin 2019'' : "CSA CCM v3.0.1 Addendum - NIST 800-53 Rev 4 Moderate".
<<<
//This document aims to determine the extent to which a NIST 800-53 Rev 4 Moderate compliant organization can meet CCM requirements. The document includes controls mappings and gap analysis.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j6b3/|https://cloudsecurityalliance.fr/go/j6b3/]]''



[img(25%,1px)[iCSF/BluePixel.gif]]
Article de blog publié le 10 juin — Rédigé par Victor Chin, Research Analyst, Cloud Security Alliance
<<<
[>img(200px,auto)[iCSA_/top20ERP.png]]//Cloud technologies are being increasingly adopted by organizations, regardless of their size, location or industry. And it's no different when it comes to business-critical applications, typically known as enterprise resource planning (ERP) applications. Most organizations are migrating business-critical applications to a hybrid architecture of ERP applications. To assist in this process, CSA has released the Top 20 Critical Controls for Cloud Enterprise Resource Planning (ERP) Customers, a report that assesses and prioritizes the most critical controls organizations need to consider when transitioning their business-critical applications to cloud environments.
This document provides 20 controls, grouped into domains for ease of consumption, that align with the existing CSA Cloud Control Matrix (CCM) v3 structure of controls and domains.
The document focuses on the following domains://
* //Cloud ERP Users: Thousands of different users with very different access requirements and authorizations extensively use cloud//
* //enterprise resource planning applications. This domain provides controls aimed to protect users and access to cloud enterprise resource planning.//
* //Cloud ERP Application: An attribute associated with cloud ERP applications is the complexity of the technology and functionality provided to users. This domain provides controls that are aimed to protect the application itself.//
* //Integrations: Cloud ERP applications are not isolated systems but instead tend to be extensively integrated and connected to other applications and data sources. This domain focuses on securing the integrations of cloud enterprise resource planning applications.//
* //Cloud ERP Data: Cloud enterprise resource planning applications store highly sensitive and regulated data. This domain focuses on critical controls to protect access to this data.//
* //Business Processes: Cloud enterprise resource planning applications support some of the most complex and critical business processes for organizations. This domain provides controls that mitigate risks to these processes.//
//While there are various ERP cloud service models such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) -- each with different security/service-level agreements and lines of responsibility -- organizations are required to protect their own data, users and intellectual property (IP). As such, organizations that are either considering an ERP cloud migration or already have workloads in the cloud can use these control guidelines to build or bolster a strong foundational ERP security program.
By themselves, ERP applications utilize complex systems and, consequently, are challenging to secure. In the cloud, their complexity increases due to factors such as shared security models, varying cloud service models, and the intersection between IT and business controls. Nevertheless, due to cloud computing benefits, enterprise resource planning applications are increasingly migrating to the cloud.
Organizations should leverage this document as a guide to drive priorities around the most important controls that should be implemented while adopting Cloud ERP Applications. The CSA ERP Security Working Group will continue to keep this document updated and relevant. In the meantime, the group hopes readers find this document useful when migrating or securing enterprise resource planning applications in the cloud.//
<<<
* +++*[Détails complémentaires »]> <<tiddler [[2019.06.10 - Publication : Top 20 Critical Controls for Cloud Enterprise Resource Planning (ERP) Customers]]>>=== 
* &rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/06/10/cloud-erp-top-20-critical-controls/]] sur le blog de la CSA
!"//Top 20 Critical Controls for Cloud ERP Customers//"
<<<
[>img(150px,auto)[iCSA_/top20ERP.png]]//This document aims to be a guide for assessing and prioritizing the most critical controls that organizations should take into account when trying to secure their business-critical applications in the cloud. The document also contains an overview of cloud ERP security, control details and associated threats and risks.//
//''Executive Summary''//
//Cloud technologies are being increasingly adopted by organizations, regardless of their size, location or industry. When it comes to business-critical applications, typically known as enterprise resource planning (ERP) applications, it is no different.
Most organizations are migrating business-critical applications to a hybrid architecture of ERP applications.
To assist in this process, the Top 20 Critical Controls for Cloud ERP Customers document assesses and prioritizes the most critical controls organizations need to consider when transitioning their business-critical applications to cloud environments.//
[...]
//''IT Application Controls''//
//Categories of information technology (IT) application controls may include://
* //Completeness checks -- controls that ensure all records were processed from initiation to completion//
* //Validity checks -- controls that ensure only valid data is input or processed//
* //Identification -- controls that ensure all users are uniquely and irrefutably identified//
* //Authentication -- controls that ensure only approved business users have access to the application system//
* //Authorization -- controls that ensure user rights to functions and data is authorized//
* //Input controls -- controls that ensure data integrity fed from upstream sources into the application system//
* //Forensic controls -- controls that ensure data and systems can produce forensic evidence in the event of an incident//
[...]
//''Control Domains''//
//This document provides 20 controls, grouped into domains for ease of consumption, that align with the existing CSA Cloud Control Matrix (CCM) 3 structure of controls and domains. The document focuses on the following domains://
* //Cloud ERP Users: Thousands of different users with very different access requirements and authorizations extensively use cloud ERP applications. This domain provides controls aimed to protect users and access to the cloud ERP.//
* //Cloud ERP Application: An attribute associated with cloud ERP applications is the complexity of the technology and functionality provided to users. This domain provides controls that are aimed to protect the application itself.//
* //Integrations: Cloud ERP applications are not isolated systems but instead tend to be extensively integrated and connected to other applications and data sources. This domain focuses on securing the integrations of cloud ERP applications.//
* //Cloud ERP Data: Cloud ERP applications store highly sensitive and regulated data. This domain focuses on critical controls to protect access to this data.//
* //Business Processes: Cloud ERP applications support some of the most complex and critical business processes for organizations. This domain provides controls that mitigate risks to these processes.//
[...]
//''Controls and Responsibility Model''//
//The building blocks of this document are the individual 20 controls, identified and documented as the most critical issues faced by cloud ERP customers. Each control provides the following sections://
* //Domain: The domain assigned to the control//
* //Control identification (ID): Unique name for the control//
* //Control Description: A description of the control and how it should be addressed//
* //Control Objectives: A description of what the control seeks to achieve//
* //Threats and Risks: Threats mitigated by the control, including those defined in the [[Treacherous 12: Top Threats to Cloud Computing|2016.02.29 - Publication : The Treacherous Twelve]] 2016 report (published by the CSA Top Threats Working Group)//
* //Related CCM Controls: If applicable, the IDs of the controls, as defined in the CSA CCM//
[...]
//''Conclusion''//
//By themselves, ERP applications utilize complex systems and, consequently, are challenging to secure.
In the cloud, their complexity increases due to factors such as shared security models, varying cloud service models and the intersection between IT and business controls. Nevertheless, due to cloud computing benefits, ERP applications are increasingly migrating to the cloud.
Organizations should leverage this document as a guide to drive priorities around the most important controls that should be implemented while adopting Cloud ERP Applications.
The CSA ERP Security Working Group will continue to keep this document updated and relevant. In the meantime, the group hopes readers find this document useful when migrating or securing ERP applications in the cloud.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j6ax/|https://cloudsecurityalliance.fr/go/j6ax/]]''
!1 - Les nouveautés CSA de la semaine du 3 au 9 juin 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Publication : ''PLA Code of Practice Template Annex 1'' (mise à jour de mai 2019)'+++*[»]> <<tiddler [[2019.06.03 - Publication : PLA Code of Practice Template Annex 1 (Mai 2019)]]>>=== 
* Publication : ''Code of Conduct (CoC) for GDPR Compliance'' (mise à jour de mai 2019)'+++*[»]> <<tiddler [[2019.06.03 - Publication : Cloud Security Alliance Code of Conduct for GDPR Compliance (Mai 2019)]]>>=== 
!2 - Veille Web
La [[Veille Web|2019.06.09 - Veille Hebdomadaire]] avec une cinquantaine de liens dont :
* Des explications de la panne //Google// Cloud du 2 juin
* Protection contre BlueKeep dans //Azure//, et utilisation d'//Azure// pour héberger du malware et des C2
* Quelques bonnes pratiques du NCSC UK, pour //Azure AD//, pour //AWS//
* Rapport d'état des lieux Cloud et sécurité de //Delta Risk//
* Suite de la vulnérabilité //rkt//
!3 - Agenda
* ''24 juin'' : ''CSA EMEA Summit'' à Tel Aviv (agenda publié)+++*[»]> <<tiddler [[2019.06.24 - CSA EMEA Summit 2019 - Tel Aviv]]>>=== 
* ''28 juin'' : clôture de l'appel à présentations pour le ''CSA Congress EMEA'' des 20 et 21 novembre 2019 à Berlin+++*[»]> <<tiddler [[2019.03.30 - CSA Congress EMEA 2019 - Appel à présentations]]>>=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Juin|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.06.09|
|2019.06.08|Security BSides London|[[AWS Vs Azure Security|https://www.youtube.com/watch?v=MXlFulaFwSA]] par Paul Schwarzenberger (vidéo)|Conférence AWS Azure|
|>|>|>|!2019.06.08|
|2019.06.08|Interesting Engineering|[[Researchers Find You Can Train AI to Create Fake UN Speeches in Under 13 Hours|https://interestingengineering.com/researchers-find-you-can-train-ai-to-create-fake-un-speeches-in-under-13-hours]]|Misc|
|2019.06.08|CyberDefense Mag|[[Proxy vs. API CASB: An Overlooked Choice in Cloud Security|https://www.cyberdefensemagazine.com/proxy-vs-api-casb-an-overlooked-choice-in-cloud-security/]]|[CASB|
|>|>|>|!2019.06.07|
|2019.06.07|BetaNews|[[The ABCs of Microsoft Office 365's Data Loss Prevention (DLP)|https://betanews.com/2019/06/07/the-abcs-of-microsoft-office-365s-data-loss-prevention-dlp/]]|O365 DLP|
|2019.06.07|GBHacker On Security|[[Secure Cloud Migration Guide - Technical and Business Considerations|https://gbhackers.com/cloud-migration-guide/]]|Migration|
|2019.06.07|DZone|[[Zero-Trust Security: How to Secure Your Data for Cloud Computing|https://dzone.com/articles/zero-trust-security-how-to-secure-your-data-for-cl]]|Misc|
|2019.06.07|//Vera Security//|[[Controlling Data in a Post-cloud World|http://vmblog.com/archive/2019/06/07/controlling-data-in-a-post-cloud-world.aspx]]|Controls|
|2019.06.07|//Microsoft//|[[Microsoft Wants More Security Researchers to Hack Into Its Cloud|https://www.bloomberg.com/news/articles/2019-06-07/microsoft-wants-more-security-researchers-to-hack-into-its-cloud]]|Azure BugBounty|
|>|>|>|!2019.06.06|
|2019.06.06|NIST|![[A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data|https://csrc.nist.gov/publications/detail/nistir/8221/final]] ([[pdf doceument|https://nvlpubs.nist.gov/nistpubs/ir/2019/NIST.IR.8221.pdf]])|Hypervisor Forensics NIT|
|2019.06.06|NCSC UK|[[Applying the Cloud Security Principles in practice: a case study|https://www.ncsc.gov.uk/blog-post/applying-the-cloud-security-principles]]|Best_Practices|
|2019.06.06|Security Mag|[[The Top Five Security Cloud App Events for Organizations to Monitor|https://www.securitymagazine.com/articles/90335-the-top-five-security-cloud-app-events-for-organizations-to-monitor]]|Monitoring|
|2019.06.06|Bleeping Computer|[[Microsoft Warns Against Bypassing Office 365 Spam Filters|https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-against-bypassing-office-365-spam-filters/]]|O365 Spam|
|2019.06.06|eSecurity Planet|[[Data Storage Security: Best Practices for Security Teams|https://www.esecurityplanet.com/cloud/data-storage-security.html]]|Storage|
|2019.06.06|DZone|[[Link Collection: Docker|https://dzone.com/articles/link-collection-docker]]|Docker|
|2019.06.06|Wired|![[The Catch-22 That Broke the Internet|https://www.wired.com/story/google-cloud-outage-catch-22/]]|Outage GCP|
|2019.06.06|//Fox IT//|[[Syncing yourself to Global Administrator in Azure Active Directory|https://blog.fox-it.com/2019/06/06/syncing-yourself-to-global-administrator-in-azure-active-directory/]]|Azure ActiveDirectory|
|2019.06.06|//ThreatStask//|[[Tips on Recruiting Top Talent in the Current DevOps and Cloud Security Markets|https://www.threatstack.com/blog/tips-on-recruiting-top-talent-in-the-current-devops-and-cloud-security-markets]]|Hiring|
|2019.06.06|Redmond Channel partner|[[Microsoft Lets Orgs Save Their Office 365 Settings in Its Cloud|https://rcpmag.com/articles/2019/06/06/microsoft-office-365-settings-cloud.aspx]]|O365|
|2019.06.06|//PaloAlto Networks//|![[Misconfigured and Exposed: Container Services|https://unit42.paloaltonetworks.com/misconfigured-and-exposed-container-services/]]|Containers Misconfiguration|
|2019.06.07|//Cyware//| → [[Over 40,000 Containers with default configurations found online|https://cyware.com/news/over-40000-containers-with-default-configurations-found-online-bf0e98d3]]|Containers Misconfiguration|
|2019.06.06|//Lastline//|[[Live from InfoSecurity Europe 2019: Understanding the Cloud Security Conversation|https://www.lastline.com/blog/live-from-infosecurity-2019-understanding-the-cloud-security-conversation/]]|Conference|
|2019.06.06|Health Data Management|[[HIT Think Security challenges in native cloud, hybrid and multi-cloud environments|https://www.healthdatamanagement.com/opinion/data-security-challenges-in-native-cloud-hybrid-and-multi-cloud-environments]]|CSA|
|2019.06.06|CISO MAG|[[With cloud expanding, users need umbrella the most|https://www.cisomag.com/with-cloud-expanding-users-need-umbrella-the-most/]]|CSA|
|2019.06.06 |MeriTalk|[[Study Finds Cloud Still Faces Security Concerns Amid Migrations|https://www.meritalk.com/articles/study-finds-cloud-still-faces-security-concerns-amid-migrations/]]|CSA|
|>|>|>|!2019.06.05|
|2019.06.05|Silicon Angle|[[Setting rivalry aside, Microsoft and Oracle link their public clouds to go after AWS|https://siliconangle.com/2019/06/05/setting-rivalry-aside-microsoft-oracle-link-public-clouds-go-aws/]]|Microsoft Oracle AWS|
|2019.06.05|DZone|[[We Turned Off AWS Config|https://dzone.com/articles/we-turned-off-aws-config]]|AWS Configuration|
|2019.06.05|InfoSec Write-Ups|[[From SSRF To AWS Credentials Disclosure|https://medium.com/bugbountywriteup/from-ssrf-to-aws-credentials-disclosure-64c51e1bf5dc]]|AWS Attacks|
|2019.06.05|Infosec Island|[[Utilising the Benefits of Industrial Robots Securely|http://www.infosecisland.com/blogview/25198-Utilising-the-Benefits-of-Industrial-Robots-Securely.html]]|Cloud Misc.|
|2019.06.05|//Cruise//|[[Building a Container Platform at Cruise (1/2)|https://medium.com/cruise/building-a-container-platform-at-cruise-part-1-507f3d561e6f]]|Containers|
|2019.06.05|//CloudPassage//|![[AWS Cloud Security Report|https://blog.cloudpassage.com/2019/06/05/aws-cloud-security-report-2019/|https://www.cybersecurity-insiders.com/4-key-takeaways-from-the-aws-cloud-security-report-2019-2/]] ([[rpport|2019|https://pages.cloudpassage.com/AWS-Cloud-Security-Report.html]])|Report AWS|
|2019.06.05|//Rapid7//|[[Scan Engine Options for InsightVM in AWS: Pre-Authorized AMI vs. Manual Install|https://blog.rapid7.com/2019/06/05/to-pre-auth-or-not-to-pre-auth-that-is-the-question/]]|AWS AMI|
|2019.06.05|//Pivot Security//|[[5 Top Information Security Accreditations for SaaS Providers|https://www.pivotpointsecurity.com/blog/security-accreditations-for-saas-providers/]]|Accreditation|
|2019.06.05|//Lacework//|[[Host Intrusion Detection for Compliance in AWS and Multicloud Environments|https://www.lacework.com/host-intrusion-detection-compliance-aws-multicloud/]]|Detection|
|2019.06.05|//Fugue//|[[Embrace chaos to improve cloud infrastructure resilience|https://www.helpnetsecurity.com/2019/06/05/improve-cloud-infrastructure-resilience/]]|Netflix Chaos|
|2019.06.05|//Forcepoint//|[[Ponemon Survey Results: US Federal Cloud Adoption|https://www.forcepoint.com/blog/insights/ponemon-survey-results-us-federal-cloud-adoption]] ([[rapport|https://www.forcepoint.com/resources/whitepapers/cloud-adoption-across-federal-government-agencies]])|Report|
|2019.06.05|//Druva//|[[Osterman Research: Don't Take Office 365 Data Protection for Granted|https://www.druva.com/blog/osterman-research-dont-take-office-365-data-protection-for-granted/]] ([[rapport|https://go.druva.com/WC-OstermanResearchReportO365_LPRegistration.html]])|Report O365|
|>|>|>|!2019.06.04|
|2019.06.04|devops.com|[[What is Cloud-Native Workload Protection?|https://devops.com/what-is-cloud-native-workload-protection/]]|Protection|
|2019.06.04|DZone|[[How to Hack Your Cloud Costs|https://dzone.com/articles/cloud-cost-hacking]]|Costs|
|2019.06.04|DZone|[[Dockerless, Part 1: Which Tools to Replace Docker With And How (1/2)|https://dzone.com/articles/dockerless-part-1-which-tools-to-replace-docker-wi]]|Docker|
|2019.06.04|Maarten Goet|![[Protect yourself against CVE-2019–0708 aka #BlueKeep using Azure Sentinel and Microsoft Defender ATP|https://medium.com/@maarten.goet/protect-yourself-against-bluekeep-using-azure-sentinel-and-defender-atp-d308f566d5cf]]|Azure BlueKeep|
|2019.06.04|//Delta Risk//|![[2019 Cloud Security Report|https://go.deltarisk.com/2019-cloud-security-report]] (inscription requise)|Report|
|2019.06.04|//Delta Risk//| → [[2019 Cloud Security Report Reveals Top Challenges|https://deltarisk.com/blog/new-research-2019-cloud-security-report-reveals-top-challenges-and-concerns/]]|Report|
|2019.06.04|//Microsoft//|![[Step 10. Detect and investigate security incidents: top 10 actions to secure your environment|https://www.microsoft.com/security/blog/2019/06/04/step-10-detect-investigate-security-incidents-top-10-actions-secure-your-environment/]]|Azure IncidentHandling|
|2019.06.04|//Google//|[[Cloud Asset Inventory: Easier inventory management, security analysis and config monitoring|https://cloud.google.com/blog/products/identity-security/with-cloud-asset-inventory-get-easier-inventory-management-security-analysis-and-config-monitoring]]|GCP Inventory|
|2019.06.04|//Netskope//|[[Cloud Security Use Case #2: Granular Control of Unmanaged Cloud Apps|https://www.netskope.com/blog/cloud-security-granular-control-unmanaged-apps]]|CASB|
|2019.06.04|//Alibaba//|[[Alibaba Cloud ECS Instance Security Checklist for Ubuntu 16.04|https://medium.com/@Alibaba_Cloud/alibaba-cloud-ecs-instance-security-checklist-for-ubuntu-16-04-afccc9b54199]]|Hardening|
|2019.06.04|//PaloAlto Networks//|[[Your AWS S3 Bucket Safety Checklist|https://blog.paloaltonetworks.com/cloud-your-aws-s3-bucket-safety-checklist/]]|AWS S3 Controls Best_Practices|
|2019.06.04|//Capsule8//|[[Escaping like a Rocket via rkt enter|https://capsule8.com/blog/escaping-like-a-rocket-via-rkt-enter/]]|rkt Container Vulnerability|
|2019.06.04|//Sysdig//|[[Kubernetes admission controllers for secure deployments|https://sysdig.com/blog/kubernetes-admission-controllers/]]|Kubernetes|
|2019.06.04|Enterprise Security|[[Tips to Improve Cloud Provider's Security|https://www.enterprisesecuritymag.com/news/tips-to-improve-cloud-provider-s-security-nid-1224-cid-17.html]]|CSA|
|>|>|>|!2019.06.03|
|2019.06.03|Container Journal|[[Microservices, Containers and Kubernetes: Which Applications Benefit?|https://containerjournal.com/2019/06/03/microservices-containers-and-kubernetes-which-applications-benefit/]]|Containers Kubernetes|
|2019.06.03|GBHackers|[[Hackers Abusing Microsoft Azure to Deploy Malware and C2 Servers Using Evasion Technique|https://gbhackers.com/microsoft-azure-to-deploy-malware/]]|Azure Evasion|
|2019.06.03|SC Mag| → [[Threat actors host malware, C2 servers on Microsoft Azure|https://www.scmagazine.com/home/security-news/malware/cyber-criminals-are-storing-malicious-content-including-malware-and-c2-servers-on-microsofts-azure-cloud-services/]]|Azure Evasion|
|2019.06.03|CIO Review|[[Disaster Recovery: The Enterprise Cloud Is Coming of Age|https://cisco.cioreview.com/cxoinsight/disaster-recovery-the-enterprise-cloud-is-coming-of-age-nid-7600-cid-61.html]]|DRaaS|
|2019.06.03|DZone|[[Cloud Computing Security: Secure Your Data, Not Just Your Perimeter|https://dzone.com/articles/cloud-computing-security-secure-your-data-not-just]]|DataProtection|
|2019.06.03|DZone|[[50% of Developers Don't Scan Their Docker Images for Vulnerabilities at All|https://dzone.com/articles/50-of-developers-dont-scan-their-docker-images-for]]|Docker Prevention|
|2019.06.03|CISO Mag|[[Cybersecurity insurers in the cloud space creating a new paradox|https://www.cisomag.com/cybersecurity-insurers-in-the-cloud-space-creating-a-new-paradox/]]|Insurance|
|2019.06.03|Platform9|[[The Gorilla Guide to Kubernetes in the Enterprise, Chapter 3: Deploying Kubernetes|https://platform9.com/blog/kubernetes-enterprise-chapter-3-deploying-kubernetes/]]|Kubernetes|
|2019.06.03|//Google//|![[An update on Sunday's service disruption|https://cloud.google.com/blog/topics/inside-google-cloud/an-update-on-sundays-service-disruption]]|Outage GCP|
|2019.06.03|ThousandEyes| → [[Google Cloud Platform Outage Analysis|https://blog.thousandeyes.com/google-cloud-platform-outage-analysis/]]|Outage GCP|
|2019.06.03|ITpro|[[What is cloud-to-cloud backup?|https://www.itpro.co.uk/cloud-backup/33760/what-is-cloud-to-cloud-backup]]|Backup|
|2019.06.03|Infosec Institute|[[CCSP vs. Cloud+|https://resources.infosecinstitute.com/ccsp-vs-cloud-plus/]]|Certification|
|2019.06.03|DZone|[[Azure Kubernetes Service (AKS) Security Features|https://dzone.com/articles/aks-scratch-to-production-ready]]|Azure Kubernetes|
|2019.06.03|//Fortinet//|[[Four Essential Cloud Security Concepts|https://www.fortinet.com/blog/industry-trends/essential-cloud-security-concepts.html]]|Best_Practices|
|2019.06.03|//Fortinet//|[[Delivering on the Promise of the Cloud Requires Consistent Security|https://www.csoonline.com/article/3399980/delivering-on-the-promise-of-the-cloud-requires-consistent-security.html]]|Best_Practices|
|2019.06.03|//Gemalto//|[[One Year Later: Finding Harmony between GDPR and the Cloud|https://blog.gemalto.com/security/2019/06/04/one-year-later-finding-harmony-between-gdpr-and-the-cloud/]]]|GDPR|
|2019.06.03|//Anchore//|[[A Policy Based Approach to Container Security and Compliance|https://anchore.com/policy-based-compliance-approach-to-container-security/]]|Containers|
|2019.06.03|//Aqua//|[[Kubernetes RBAC: Asking for Forgiveness or Getting Permission|https://blog.aquasec.com/kubernetes-rbac]]|Kubernetes RBAC|
|2019.06.03|//StorageCraft//|[[Why You're Not Ready for Cloud Computing Challenges – and What to Do About It?|https://blog.storagecraft.com/cloud-computing-challenges/]]|Challenges|
|>|>|>|!|
||//IS Decisions//[>img[iCSF/flag_fr.png]]|[[Cloud et Sécurité: une alliance nébuleuse|https://www.isdecisions.fr/probleme-securite-stockage-cloud/]]|Report Storage|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Juin 2019]]>>
!"//Cloud Security Alliance Code of Conduct for GDPR Compliance (Updated - May 2019)//"
[>img(200px,auto)[iCSA/J5GDPRCoC.png]]Mise à jour de Mai 2019
<<<
//The CSA Code of Conduct is designed to offer both a compliance tool for GDPR compliance and transparency guidelines regarding the level of data protection offered by the Cloud Service Provider.//
<<<
__Table des Matières__
| I|INTRODUCTION|
| II|BACKGROUND INFORMATION|
| III|STRUCTURE OF THE CSA CoC FOR GDPR COMPLIANCE|
|>|!PART 1 CSA CoC OBJECTIVES, SCOPE, METHODOLOGY, ASSUMPTIONS & EXPLANATORY NOTES|
| 1|OBJECTIVES OF THE CSA COC|
| 2|SCOPE AND METHODOLOGY|
| 3|ASSUMPTIONS|
| 3.1|Cloud Customer Internal Due Diligence|
| 3.2|Cloud Customer External Due Diligence|
| 4|EXPLANATORY NOTES|
|>|!PART 2 PRIVACY LEVEL AGREEMENT CODE OF PRACTICE|
| 1|CSP DECLARATION OF COMPLIANCE AND ACCOUNTABILITY|
| 2|CSP RELEVANT CONTACTS AND ITS ROLE|
| 3|WAYS IN WHICH DATA WILL BE PROCESSED|
| 3.1|General information|
| 3.2|Personal data location|
| 3.3|Subcontractors|
| 3.4|Installation of software on cloud customer's system|
| 3.5|Data processing contract (or other binding legal act)|
| 4|RECORDKEEPING|
| 4.1|Recordkeeping for CSP-controller|
| 4.2|Recordkeeping for CSP-processor|
| 5|DATA TRANSFER|
| 6|DATA SECURITY MEASURES|
| 7|MONITORING|
| 8|PERSONAL DATA BREACH|
| 9|DATA PORTABILITY, MIGRATION, AND TRANSFER BACK|
| 10|RESTRICTION OF PROCESSING|
| 11|DATA RETENTION, RESTITUTION, AND DELETION|
| 11.1|Data retention, restitution, and deletion policies|
| 11.2|Data retention|
| 11.3|Data retention for compliance with sector-specific legal requirements|
| 11.4|Data restitution and/or deletion|
| 12|COOPERATION WITH THE CLOUD CUSTOMERS|
| 13|LEGALLY REQUIRED DISCLOSURE|
| 14|REMEDIES FOR CLOUD CUSTOMERS|
| 15|CSP INSURANCE POLICY|
|>|!PART 3 CSA CODE OF CONDUCT GOVERNANCE AND ADHERENCE MECHANISMS|
| 1|TECHNICAL COMPONENTS|
| 1.1|PLA Code of Practice|
| 1.2|Adherence mechanisms to the Code|
| 1.2.1|CoC Self-Attestation|
| 1.2.2|CoC Third-Party Assessment|
| 1.3|Code of Ethics|
| 1.4|PLA and OCF Working Group Charters|
| 2|GOVERNANCE BODIES, ROLES AND RESPONSIBILITIES|
| 2.1|PLA Working Group|
| 2.2|OCF Working Group|
| 2.3|Cloud Security Alliance (CSA)|
| 2.4|Collaboration and supporting actions toward data protection Supervisory Authorities|
| 2.5|CoC Monitoring Body|
| 2.5.1|Independence|
| 2.5.2|Absence of a conflict of interests|
| 2.5.3|Expertise|
| 2.5.4|Resources and staffing|
| 2.5.5|Established procedures and structures|
| 2.5.6|Transparent complaints handling|
| 2.5.7|Communication with the competent Supervisory Authority|
| 2.5.8|Review mechanisms|
| 2.5.9|Legal status|
| 2.5.10|Continuous improvement|
| 2.5.11|Monitoring|
| 3|GOVERNANCE PROCESS AND RELATED ACTIVITIES|
| 3.1|PLA Code of Practice review process|
| 3.2|CoC adherence scheme review process|
| 3.3|CoC seals issuing and Statement of Adherence publication|
| 3.3.1|CoC self-attestation|
| 3.3.2|CoC third-party assessment|
| 3.4|Complaint Management Process|
| 3.5|Ongoing monitoring processes|
| 3.5.1|Qualified CoC Auditing Partner Monitoring Process|
| 3.6|Code of Ethics review process|
| 3.7|PLA and OCF WG charters documents review process|
|>|!ANNEXES|
||ANNEX 1: PLA [3] TEMPLATE|
||ANNEX 2: STATEMENT OF ADHERENCE TEMPLATE|
||ANNEX 3: THE CSA STAR PROGRAM AND OPEN CERTIFICATION FRAMEWORK (OCF)|
||ANNEX 4: CODE OF ETHICS|
||ANNEX 5: PRIVACY LEVEL AGREEMENT WORKING GROUP CHARTER|
||ANNEX 6: OPEN CERTIFICATION FRAMEWORK WORKING GROUP CHARTER|
||ANNEX 7: COMPLAINT MANAGEMENT PROCESS|
||ANNEX 8: MONITORING/AUDIT PROCESS| 
* Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j63d/|https://cloudsecurityalliance.fr/go/j63d/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//PLA Code of Practice Template Annex 1 (Updated - May 2019)//"
[>img(100px,auto)[iCSA/CSAdoc.png]]Mise à jour de Mai 2019
<<<
//CSA PLA Code of Conduct for GDPR Compliance provides a consistent and comprehensive framework for complying with the EU's GDPR. The CSA PLA Code of Conduct for GDPR Compliance is designed to be an appendix to a Cloud Services Agreement to describe the level of privacy protection that a Cloud Service Provider will provide.//
<<<
* Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j63p/|https://cloudsecurityalliance.fr/go/j63p/]]''




[img(25%,1px)[iCSF/BluePixel.gif]]
!1 - Les nouveautés CSA de la semaine du 27 mai au 2 juin 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Appel à commentaires sur le document "''Six Pillars of DevSecOps''"+++*[»]> <<tiddler [[2019.05.22 - Actu : Appel à commentaires, document 'Les Six Piliers de DevSecOps']]>>=== (''avant le __6 juin__'')
* Blog : "''Votre feuille de route pour obtenir la certification CCSK''"+++*[»]> <<tiddler [[2019.05.28 - Blog : Votre feuille de route pour obtenir la certification CCSK]]>>=== 
!2 - Veille Web
La [[Veille Web|2019.06.02 - Veille Hebdomadaire]] avec une cinquantaine de liens dont :
* Arrêt du site d'information CloudMagazine.fr
* Encore et toujours des données mal protégées et exposées dans le Cloud
* Docker : Vulnérabilité CVE-2018-15664, et exploitation de la CVE-2019-5736 connue depuis 3 mois
* Un avertissement de l'OCIE (Office of Compliance Inspections and Examinations) de la SEC (Securities and Exchange Commission) sur le stockage de données dans le Cloud
* Durcissement dans le Cloud
!3 - Agenda
* 24 juin : ''CSA EMEA Summit'' à Tel Aviv+++*[»]> <<tiddler [[2019.06.24 - CSA EMEA Summit 2019 - Tel Aviv]]>>=== 
* 28 juin : clôture de l'appel à présentations pour le ''CSA Congress EMEA'' des 20 et 21 novembre 2019 à Berlin+++*[»]> <<tiddler [[2019.03.30 - CSA Congress EMEA 2019 - Appel à présentations]]>>=== 
!4 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]])
|!Juin|!Sources|!Titres et Liens|!Keywords|
|2019.06.02|Bleeping Computer|[[Google Outage in Eastern U.S. Affecting Gmail, YouTube, and More|https://www.bleepingcomputer.com/news/google/google-outage-in-eastern-us-affecting-gmail-youtube-and-more/]]|Outage GCP|
|2019.06.02|Bleeping Computer| → [[Networking issues take down Google Cloud in parts of the U.S. and Europe, YouTube and Snapchat also affected|https://www.geekwire.com/2019/networking-issues-take-google-cloud-parts-u-s-europe-youtube-snapchat-also-affected/]]|Outage GCP|
|2019.06.02|8BitMen|![[A Super Helpful Guide to Understanding Workload & It's Types in Cloud|https://www.8bitmen.com/a-super-helpful-guide-to-understanding-workload-its-types-in-cloud/]]|Workloads|
|>|>|>|!|
|2019.06.01|Bleeping Computer|[[Microsoft Azure Being Used to Host Malware and C2 Servers|https://www.bleepingcomputer.com/news/security/microsoft-azure-being-used-to-host-malware-and-c2-servers/]]|Azure Attacks|
|!Mai|!Sources|!Titres et Liens|!Keywords|
|2019.05.31|cloudmagazine.fr|![[Après plus de 10 ans, cloudmagazine.fr ferme|https://www.cloudmagazine.fr/]]|Misc|
|2019.05.31|Phys.org|[[Vulnerability of cloud service hardware uncovered|https://phys.org/news/2019-05-vulnerability-cloud-hardware-uncovered.html]]|Hardware Vulnerability|
|2019.06.03|HelpNet Security| → [[Scientists uncover vulnerability in FPGAs, affecting cloud services and IoT|https://www.helpnetsecurity.com/2019/06/03/vulnerability-in-fpgas/]]|Hardware Vulnerability|
|2019.05.31|Law.com|[[A Line in the Clouds: Whose Cybersecurity Goes Where?|https://www.law.com/newyorklawjournal/2019/05/31/a-line-in-the-clouds-whose-cybersecurity-goes-where/]]|Legals|
|2019.05.31|//Zscaler//|[[Phishing Email States Your Office 365 Account Will Be Deleted|https://www.bleepingcomputer.com/news/security/phishing-email-states-your-office-365-account-will-be-deleted/]]|O365 Phishing|
|2019.05.31|//Google//|[[Scan BigQuery for sensitive data using Cloud DLP|https://cloud.google.com/blog/products/data-analytics/scan-bigquery-for-sensitive-data-using-cloud-dlp]]|GCP DLP|
|2019.05.31|//Whistic//|[[Phase 1 of The 5 phases of Responding to a Security Questionnaire & How to Get Proactive (1/5)|https://blog.whistic.com/phase-1-of-the-5-phases-of-responding-to-a-security-questionnaire-how-to-get-proactive-43b326eed980]]|Misc|
|2019.05.31|Trojaner|[[Studie der Cloud Security Alliance identifiziert neue und einzigartige Sicherheitsprobleme in nativen, hybriden und Multi-Cloud-Umgebungen|https://www.trojaner-info.de/business-security/aktuell/studie-der-cloud-security-alliance-identifiziert-neue-und-einzigartige-sicherheitsprobleme-in-nativen-hybriden-und-multi-cloud-u.html]]|CSA|
|>|>|>|!|
|2019.05.30|Digital Shadows|[[2.3 billion files exposed across online file storage technologies|https://www.digitalshadows.com/blog-and-research/2-billion-files-exposed-across-online-file-storage-technologies/]] ([[rapport|https://info.digitalshadows.com/TooMuchInfoTheSequel-blog.html]])|Data_Leaks|
|2019.05.30|HelpNet Security| → [[2.3B Files Currently Exposed via Online Storage|https://www.darkreading.com/threat-intelligence/23b-files-currently-exposed-via-online-storage/d/d-id/1334843]]|Data_Leaks|
|2019.05.30|Threatpost| → [[2.3B Files Exposed in a Year: A New Record for Misconfigs|https://threatpost.com/files-exposed-record-misconfigs/145177/]]|Data_Leaks|
|2019.05.30|ZDnet| → [[Cybersecurity: The number of files exposed on misconfigured servers, storage and cloud services has risen to 2.3 billion|https://www.zdnet.com/article/cybersecurity-the-number-of-files-exposed-on-misconfigured-servers-storage-and-cloud-services-has-risen-to-2-3-billion/]]|Data_Leaks|
|2019.05.30|CBR Online| → [[Colossal 2.3 Billion Files Now Exposed Online|https://www.cbronline.com/news/files-exposed-online]]|Data_Leaks|
|2019.06.03|//Lacework//| → [[Misconfigured Servers Leave 2.3 Billion Private Files Exposed|https://www.lacework.com/misconfigured-servers-s3-billion-files-exposed/]]|Data_Leaks|
|2019.05.30|SecurityTrails|[[Cloud security, open S3 buckets and where do we stand now: Interview with Vincent Yiu|https://securitytrails.com/blog/vincent-yiu]]|
|2019.05.30|CSO Online|[[A hacker or your cloud provider. Who presents the greatest risk to your data?|https://www.csoonline.com/article/3386838/a-hacker-or-your-cloud-provider-who-presents-the-greatest-risk-to-your-data.html#tk.rss_cloudsecurity]]|Risks|
|2019.05.30|//Twistlock//|[[Breaking Out of rkt - 3 New Unpatched CVEs|https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/]]|rkt Container Vulnerability|
|2019.06.02|SecurityWeek| → [[rkt Container Runtime Flaws Give Root Access to Host|https://www.securityweek.com/rkt-container-runtime-flaws-give-root-access-host]]|rkt Container Vulnerability|
|2019.05.30|//Appriver//|[[Threat Alert: Malware Being Hosted On Azure|https://blog.appriver.com/threat-alert-microsoft-azure-malware]]|Alert Azure|
|2019.05.30|//TrendMicro//|![[Infected Cryptocurrency-Mining Containers Target Docker Hosts With Exposed APIs, Use Shodan to Find Additional Victims|https://blog.trendmicro.com/trendlabs-security-intelligence/infected-cryptocurrency-mining-containers-target-docker-hosts-with-exposed-apis-use-shodan-to-find-additional-victims/]]|Docker Attacks|
|2019.05.30|Bleeping Computer| → [[Compromised Docker Hosts Use Shodan to Infect More Victims|https://www.bleepingcomputer.com/news/security/compromised-docker-hosts-use-shodan-to-infect-more-victims/]]|Docker Attacks|
|2019.05.30|//Azure//|[[Kubernetes - from the beginning, part III scaling my app|https://dev.to/azure/kubernetes-part-iii-scaling-1mmi]]|Azure Kubernetes|
|2019.05.30|//Sensu//|![[Securing your Docker containers|https://blog.sensu.io/securing-your-docker-containers]]|Docker|
|2019.05.30|APAC CIO|[[Security and Agility in the Cloud|https://cloud.apacciooutlook.com/cxoinsights/security-and-agility-in-the-cloud-nwid-6397.html]]|CSA|
|2019.05.30|//Rancher Labs//|[[An Introduction to Containers|https://rancher.com/blog/2019/an-introduction-to-containers/]]|Containers|
|>|>|>|!|
|2019.05.29|NCSC UK|[[Building Web Check using PaaS|https://www.ncsc.gov.uk/blog-post/building-web-check-using-paas]]|Controls Best_Practices|
|2019.05.29|TaoSecurity|[[Know Your Limitations|https://taosecurity.blogspot.com/2019/05/know-your-limitations.html]]|Misc|
|2019.05.23|OCIE|![[Safeguarding Customer Records and Information in Network Storage - Use of Third Party Security Features (pdf)|https://www.sec.gov/files/OCIE%20Risk%20Alert%20-%20Network%20Storage.pdf]]|Compliance Risks|
|2019.05.29|//jdSupra//| → [[SEC OCIE Issues Guidance on Advisors' and Broker-Dealers' Cloud-Based and Other Network Storage of Customer Data|https://www.jdsupra.com/legalnews/sec-ocie-issues-guidance-on-advisors-34636/]]|
|2019.05.28|Bleeping Computer| → [[Microsoft Boosts Shadow IT Discovery for Cloud Security|https://www.bleepingcomputer.com/news/security/microsoft-boosts-shadow-it-discovery-for-cloud-security/]]|ShadowIT|
|2019.05.28|Infowec Institute|[[System administrator vs. cloud administrator|https://resources.infosecinstitute.com/system-administrator-vs-cloud-administrator/]]|Administration|
|2019.05.29|//Cisco//|[[Office 365 phishing|https://blogs.cisco.com/security/office-365-phishing-threat-of-the-month]]|O365 Phishing|
|2019.05.29|//Lacework//|![[The Benefits of a Host-Based IDS for Cloud Environments|https://www.lacework.com/benefits-host-based-ids-cloud/]]|Detection|
|2019.05.28|//Platform9//|[[The Gorilla Guide to Kubernetes in the Enterprise - Chapter 2: Kubernetes Concepts and Architecture|https://platform9.com/blog/kubernetes-enterprise-chapter-2-kubernetes-architecture-concepts/]]|Kubernetes|
|2019.05.29|//Google//|[[How Google Cloud securely enables modern end-user computing|https://cloud.google.com/blog/products/identity-security/how-google-cloud-securely-enables-modern-end-user-computing]]|GCP|
|2019.05.29|//Microsoft//|[[Develop a risk management strategy for your Azure AD application migration|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Develop-a-risk-management-strategy-for-your-Azure-AD-application/ba-p/566488]]|AzureAD Risks|
|2019.05.29|//Druva//|[[Salesforce Outage Proves You Need to Backup Your SaaS Data|https://www.druva.com/blog/salesforce-outage-proves-you-need-to-backup-your-saas-data/]]|Outage|
|>|>|>|!|
|2019.05.28|MITRE CVE|Docker (all versions) is vulnerable to a symlink-race attack [[CVE-2018-15664|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15664]]|CVE-2018-15664 Docker|
|2019.05.30|Dark Reading| → [[Docker Vulnerability Opens Servers to Container Code|https://www.darkreading.com/vulnerabilities---threats/docker-vulnerability-opens-servers-to-container-code/d/d-id/1334836]]|CVE-2018-15664 Docker|
|2019.05.30|InfoRisk Today| → [[Researcher Describes Docker Vulnerability|https://www.inforisktoday.com/researcher-describes-docker-vulnerability-a-12535]]|CVE-2018-15664 Docker|
|2019.05.29|SecurityWeek| → [[Docker Vulnerability Gives Arbitrary File Access to Host|https://www.securityweek.com/docker-vulnerability-gives-arbitrary-file-access-host]]|CVE-2018-15664 Docker|
|2019.05.29|The Register| → [[Contain yourself, Docker: Race-condition bug puts host machines at risk... sometimes, ish|https://www.theregister.co.uk/2019/05/29/docker_race_condition]]|CVE-2018-15664 Docker|
|2019.05.28|Seclists.org| → [[CVE-2018-15664: docker (all versions) is vulnerable to a symlink-race attack|https://seclists.org/oss-sec/2019/q2/131]]|CVE-2018-15664 Docker|
|2019.05.28|Bleeping Computer| → [[Unpatched Flaw Affects All Docker Versions, Exploits Ready|https://www.bleepingcomputer.com/news/security/unpatched-flaw-affects-all-docker-versions-exploits-ready/]]|CVE-2018-15664 Docker|
|2019.05.28|//Duo Security//| → [[Docker Bug Allows Root Access to Host File System|https://duo.com/decipher/docker-bug-allows-root-access-to-host-file-system]]|CVE-2018-15664 Docker|
|2019.05.28|//Capsule8//| → [[Docker Race Condition: CVE-2018-15664|https://capsule8.com/blog/race-conditions-cloudy-with-a-chance-of-r-w-access/]]|CVE-2018-15664 Docker|
|2019.05.22|GitHub| → [[daemon: archive: pause containers before doing filesystem operations #39252|https://github.com/docker/docker/pull/39252]]|CVE-2018-15664 Docker|
|2019.05.28|DataCenter Magazine[>img[iCSF/flag_fr.png]]|[[Un datacenter AWS à Brétigny-sur Orge ?|http://datacenter-magazine.fr/un-datacenter-aws-a-bretigny-sur-orge/]]|AWS France|
|2019.05.28|Secure Ideas|![[Taming the Jungle: Hardening your AWS infrastructure|https://blog.secureideas.com/2019/05/taming-the-jungle-hardening-your-aws-infrastructure.html]]|AWS Hardening|
|2019.05.28|Bleeping Computer|[[Phishing Emails Pretend to be Office 365 'File Deletion' Alerts|https://www.bleepingcomputer.com/news/security/phishing-emails-pretend-to-be-office-365-file-deletion-alerts/]]|O365 Phishing|
|2019.05.28|Rick's Cloud|[[Top 3 Security Challenges for Cloud Computing|https://rickscloud.com/top-3-security-challenges-for-cloud-computing/]]|Mitigation|
|2019.05.28|The Last Watchdog|[[Only cloud-based security can truly protect cloud-delivered web applications|https://www.lastwatchdog.com/guest-essay-only-cloud-based-security-can-truly-protect-cloud-delivered-web-applications/]]|Misc|
|2019.05.28|Gigamon|[[What Is Cloud Security?|https://blog.gigamon.com/2019/05/28/what-is-cloud-security/]]|Overview|
|2019.05.28|GCN|[[DISA tests cloud-based internet isolation|https://gcn.com/articles/2019/05/28/disa-cloud-based-internet-isolation.aspx]]|Isolation|
|2019.05.28|GovernmentCIO|[[Closing the Cyber Workforce Gap by Improving the Pipeline|https://www.governmentciomedia.com/closing-cyber-workforce-gap-improving-pipeline]]|CSA|
|2019.05.28|CIO|[[Cloud Transition - 5 Best Practices to Follow|https://www.cio.com/article/3397112/cloud-transition-5-best-practices-to-follow.html]]|CSA|
|2019.05.28|TEISS|[[Software as a security nightmare: the risks of collaboration on the cloud|https://www.teiss.co.uk/information-security/software-as-a-security-nightmare-the-risks-of-collaboration-on-the-cloud/?getcat=3007]]|SaaS Collaboration|
|2019.05.28|DZone|[[How to Create a Docker Machine with A Bridged Network Adapter|https://dzone.com/articles/how-to-create-a-docker-machine-with-a-bridged-netw]]|Docker|
|2019.05.28|//Alibaba//|![[Xulu: Cryptojacking Leveraging Shodan, Tor, and Malicious Docker Container|https://www.alibabacloud.com/blog/xulu-cryptojacking-leveraging-shodan-tor-and-malicious-docker-container_594869]]|Docker Attacks|
|2019.05.28|//Certfa//|[[Weaponizing of Google Cloud Storage for phishing attacks|https://blog.certfa.com/posts/weaponizing-of-google-cloud-storage-for-phishing-attacks/]]|GCP Phishing|
|2019.05.28|//IBM//|[[Third-Party Risks Need New Approaches|https://securityintelligence.com/posts/third-party-risks-need-new-approaches/]]|Risks|
|2019.05.28|//Armor//|[[Security in the Public Cloud|https://www.armor.com/blog/security-in-the-public-cloud-aws/]]|Public_Cloud|
|2019.05.28|//CCSI//|[[The essential checklist for Cloud security|https://www.ccsinet.com/blog/the-essential-checklist-for-cloud-security/]]|Controls|
|2019.05.28|//Google//|[[Uploading images directly to Cloud Storage using Signed URL|https://cloud.google.com/blog/products/storage-data-transfer/uploading-images-directly-to-cloud-storage-by-using-signed-url]]|GCP|
|2019.05.28|//Tripwire//|[[How to Secure Your Information on AWS: 10 Best Practices|https://www.tripwire.com/state-of-security/security-data-protection/secure-information-aws-10-best-practices/]]|AWS Best_Practices|
|2019.05.28|//McAfee//|[[Are Your Employees Using Your Data in the Shadows?|https://securingtomorrow.mcafee.com/business/cloud-security/are-your-employees-using-your-data-in-the-shadows/]]|ShadowIT|
|2019.05.28|GovernmentCIO Media|[[Closing the Cyber Workforce Gap by Improving the Pipeline|https://www.governmentciomedia.com/closing-c/yber-workforce-gap-improving-pipeline]]|CSA|
|2019.05.28|Security Boulevard|[[Is Third-Party Risk Assessment Getting Better?|https://securityboulevard.com/2019/05/is-third-party-risk-assessment-getting-better/]]|CSA|
|2019.05.28|SecTank|[[Studie der Cloud Security Alliance identifiziert neue und einzigartige Sicherheitsprobleme in nativen, hybriden und Multi-Cloud-Umgebungen|https://itbrief.com.au/story/hybrid-cloud-security-big-concern-for-business-leaders]]|CSA|
|2019.05.28|//Detectify//|[[Fitting automated security throughout the CI/CD pipeline|https://blog.detectify.com/2019/05/28/fitting-automated-security-throughout-the-ci-cd-pipeline/]]|DevSecOps|
|>|>|>|!|
|2019.05.27|DZone|[[One in a Million: How to Survive as a New Cloud Vendor|https://dzone.com/articles/if-i-am-one-amongst-the-million-selling-cloud-is-t]]|Misc|
|2019.05.27|DZone|[[Securing Kubernetes From Within and Without|https://dzone.com/articles/securing-kubernetes-from-within-and-without]]|Kubernetes|
<<tiddler .ReplaceTiddlerTitle with: [[Veille Web - Juin 2019]]>>
!Conférence technologique SIGS les 12 et 13 juin 2019
[>img(100px,auto)[iCSF/SIGS.png]]Cette conférence aura lieu à Zurich :
* Parmi les intervenants : Freddy Dezeure (ancien responsable du CERT-EU), Paul Vixie (Fairsight Security), Christian Funk (Kaspersky Lab), Richard Meeus (Akamai), Jeff Hamm (FireEye/Mandiant), Laura Koetzle (Forrester)...
* Parmi les sujets abordés : Blockchain, Digital Transformation et Sécurité du Cloud/RGPD.
* Une formation CCSK se déroulera le jeudi 13 juin. Le code "//CSA-CONF2019//" permt d'avoir une réduction.

Pour en savoir plus et s'inscrire :
* Le site de la conférence → ''[[sig-switzerland.ch/conference/|https://www.sig-switzerland.ch/conference/sigs-technology-conference-2019/]]''
* Le programme de la conférence → [[formatPDF|https://www.sig-switzerland.ch/wp-content/uploads/2019/03/2019_SIGS_Technology_Agenda_en.pdf]]
* Le détail de la formation CCSK → ''[[sig-switzerland.ch/csa-ccsk|https://www.sig-switzerland.ch/csa-ccsk/]]''
!"//What is a CASB and How Do You Even Say It?//"
[>img(100px,auto)[iCSA_/news-icon.png]]^^Bien que publié le 25 juin 2019 sur le blog de la CSA, cet article l'a déjà été il y a 3 semaines, le 3 juin 2019 sur le site de la société Bitglass.
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/06/26/what-is-a-casb-and-how-do-you-even-say-it/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.bitglass.com/blog/what-is-a-casb-how-do-you-say-it]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Bitglass Security Spotlight: G Suite User Passwords Stored in Plaintext//"
[>img(100px,auto)[iCSA_/news-icon.png]]^^Bien que publié le 6 juin 2019 sur le blog de la CSA, cet article et cette vidéo l'ont déjà été il y a une semaine, le 29 mai 2019 sur le site de la société Bitglass.
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/06/06/bitglass-security-spotlight-g-suite-user-passwords-stored-in-plaintext/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.bitglass.com/blog/bss-gsuite-user-passwords-stored-plaintext]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201905>>
<<tiddler fAll2Tabs10 with: VeilleM","_201905>>
<<tiddler fAll2LiTabs with: NewsL","201905>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Mai 2019]]>>
|!Mai|!Sources|!Titres et Liens|!Keywords|
|2019.05.28|MITRE CVE|//Docker (all versions) is vulnerable to a symlink-race attack// [[CVE-2018-15664|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15664]]|CVE-2018-15664 Docker|
|2019.05.13|US-CERT|!//Analysis Report: Microsoft Office 365 Security Observations// [[AR19-133A|https://www.us-cert.gov/ncas/analysis-reports/AR19-133A]]|O365|
|2019.05.08|MITRE CVE|//Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user.// [[CVE-2019-7021|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5021]]|CVE-2019-5021|
|>|>|>|!Vulnerabilities|
|2019.05.30|//Twistlock//|[[rkt enter vulnerabilities|https://asciinema.org/a/249284]]|rkt|
|2019.05.14|//Twistlock//|[[rkt / enter mknod POC|https://asciinema.org/a/246103]]|rkt|
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Mai 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Mai 2019]]>><<tiddler fAll2LiTabs with: Actu","201905>>
<<tiddler fAll2LiTabs with: Blog","201905>><<tiddler .ReplaceTiddlerTitle with: [[Blog - Mai 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Mai 2019]]>><<tiddler fAll2LiTabs with: Publ","201905>>